{ "CVE_data_type" : "CVE", "CVE_data_format" : "MITRE", "CVE_data_version" : "4.0", "CVE_data_numberOfCVEs" : "16286", "CVE_data_timestamp" : "2020-09-16T08:09Z", "CVE_Items" : [ { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0001", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96057", "name" : "96057", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038002", "name" : "1038002", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0001", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0001", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application, aka \"Windows GDI Elevation of Privilege Vulnerability.\" This vulnerability is different from those described in CVE-2017-0005, CVE-2017-0025, and CVE-2017-0047." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0002", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95284", "name" : "95284", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037573", "name" : "1037573", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-001", "name" : "MS17-001", "refsource" : "MS", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Edge allows remote attackers to bypass the Same Origin Policy via vectors involving the about:blank URL and data: URLs, aka \"Microsoft Edge Elevation of Privilege Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-01-10T21:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0003", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "sharepoint_enterprise_server", "version" : { "version_data" : [ { "version_value" : "2016", "version_affected" : "=" } ] } }, { "product_name" : "word", "version" : { "version_data" : [ { "version_value" : "2016", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://fortiguard.com/advisory/FG-VD-16-079", "name" : "http://fortiguard.com/advisory/FG-VD-16-079", "refsource" : "MISC", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/95287", "name" : "95287", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037568", "name" : "1037568", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037569", "name" : "1037569", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-002", "name" : "MS17-002", "refsource" : "MS", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Word 2016 and SharePoint Enterprise Server 2016 allow remote attackers to execute arbitrary code via a crafted document, aka \"Microsoft Office Memory Corruption Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-01-10T21:59Z", "lastModifiedDate" : "2018-10-12T22:15Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0004", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95318", "name" : "95318", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037571", "name" : "1037571", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-004", "name" : "MS17-004", "refsource" : "MS", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Local Security Authority Subsystem Service (LSASS) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to cause a denial of service (reboot) via a crafted authentication request, aka \"Local Security Authority Subsystem Service Denial of Service Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.8 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.9, "acInsufInfo" : true, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-01-10T21:59Z", "lastModifiedDate" : "2018-10-12T22:15Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0005", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96033", "name" : "96033", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038002", "name" : "1038002", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://blogs.technet.microsoft.com/mmpc/2017/03/27/detecting-and-mitigating-elevation-of-privilege-exploit-for-cve-2017-0005/", "name" : "https://blogs.technet.microsoft.com/mmpc/2017/03/27/detecting-and-mitigating-elevation-of-privilege-exploit-for-cve-2017-0005/", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0005", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0005", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application, aka \"Windows GDI Elevation of Privilege Vulnerability.\" This vulnerability is different from those described in CVE-2017-0001, CVE-2017-0025, and CVE-2017-0047." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 6.9 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.4, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0006", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "excel", "version" : { "version_data" : [ { "version_value" : "2007", "version_affected" : "=" } ] } }, { "product_name" : "excel_viewer", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "office_compatibility_pack", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "sharepoint_server", "version" : { "version_data" : [ { "version_value" : "2007", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96740", "name" : "96740", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038010", "name" : "1038010", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0006", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0006", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Excel 2007 SP3, Office Compatibility Pack SP3, Excel Viewer, and Excel Services on SharePoint Server 2007 SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka \"Microsoft Office Memory Corruption Vulnerability.\" This vulnerability is different from those described in CVE-2017-0019, CVE-2017-0020, CVE-2017-0030, CVE-2017-0031, CVE-2017-0052, and CVE-2017-0053." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:excel:2007:sp3:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:excel_viewer:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office_compatibility_pack:*:sp3:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:sharepoint_server:2007:sp3:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0007", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96018", "name" : "96018", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038001", "name" : "1038001", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://enigma0x3.net/2017/04/03/defeating-device-guard-a-look-into-cve-2017-0007/", "name" : "https://enigma0x3.net/2017/04/03/defeating-device-guard-a-look-into-cve-2017-0007/", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0007", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0007", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Device Guard in Microsoft Windows 10 Gold, 1511, 1607, and Windows Server 2016 allows remote attackers to modify PowerShell script without invalidating associated signatures, aka \"PowerShell Security Feature Bypass Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:N/I:P/A:N", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 2.1 }, "severity" : "LOW", "exploitabilityScore" : 3.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0008", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "internet_explorer", "version" : { "version_data" : [ { "version_value" : "9", "version_affected" : "=" }, { "version_value" : "10", "version_affected" : "=" }, { "version_value" : "11", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96073", "name" : "96073", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038008", "name" : "1038008", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0008", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0008", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Internet Explorer Information Disclosure Vulnerability.\" This vulnerability is different from those described in CVE-2017-0009 and CVE-2017-0059." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0009", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "internet_explorer", "version" : { "version_data" : [ { "version_value" : "9", "version_affected" : "=" }, { "version_value" : "10", "version_affected" : "=" }, { "version_value" : "11", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.security-assessment.com/files/documents/advisory/comparestring_infoleak.pdf", "name" : "http://www.security-assessment.com/files/documents/advisory/comparestring_infoleak.pdf", "refsource" : "MISC", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/96077", "name" : "96077", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0009", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0009", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Microsoft Browser Memory Corruption Vulnerability.\" This vulnerability is different from those described in CVE-2017-0011, CVE-2017-0017, CVE-2017-0065, and CVE-2017-0068." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0010", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96059", "name" : "96059", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0010", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0010", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0015, CVE-2017-0032, CVE-2017-0035, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0011", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96064", "name" : "96064", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0011", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0011", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Edge allows remote attackers to obtain sensitive information via a crafted web site, aka \"Microsoft Edge Information Disclosure Vulnerability.\" This vulnerability is different from those described in CVE-2017-0009, CVE-2017-0017, CVE-2017-0065, and CVE-2017-0068." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0012", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "internet_explorer", "version" : { "version_data" : [ { "version_value" : "11", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96085", "name" : "96085", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0012", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0012", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to spoof web content via a crafted web site, aka \"Microsoft Browser Spoofing Vulnerability.\" This vulnerability is different from those described in CVE-2017-0033 and CVE-2017-0069." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0014", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "office", "version" : { "version_data" : [ { "version_value" : "2010", "version_affected" : "=" } ] } }, { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96013", "name" : "96013", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038002", "name" : "1038002", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0014", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0014", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://secuniaresearch.flexerasoftware.com/secunia_research/2017-9/", "name" : "https://secuniaresearch.flexerasoftware.com/secunia_research/2017-9/", "refsource" : "MISC", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Windows Graphics Component in Microsoft Office 2010 SP2; Windows Server 2008 R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via a crafted web site, aka \"Windows Graphics Component Remote Code Execution Vulnerability.\" This vulnerability is different from that described in CVE-2017-0108." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0015", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96079", "name" : "96079", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0015", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0015", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0032, CVE-2017-0035, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0016", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-476" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95969", "name" : "95969", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037767", "name" : "1037767", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038001", "name" : "1038001", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0016", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0016", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Windows 10 Gold, 1511, and 1607; Windows 8.1; Windows RT 8.1; Windows Server 2012 R2, and Windows Server 2016 do not properly handle certain requests in SMBv2 and SMBv3 packets, which allows remote attackers to execute arbitrary code via a crafted SMBv2 or SMBv3 packet to the Server service, aka \"SMBv2/SMBv3 Null Dereference Denial of Service Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.9, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.2, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-25T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0017", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-79" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96078", "name" : "96078", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0017", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0017", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The RegEx class in the XSS filter in Microsoft Edge allows remote attackers to conduct cross-site scripting (XSS) attacks and obtain sensitive information via unspecified vectors, aka \"Microsoft Edge Information Disclosure Vulnerability.\" This vulnerability is different from those described in CVE-2017-0009, CVE-2017-0011, CVE-2017-0065, and CVE-2017-0068." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "CHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 6.1, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 2.7 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0018", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "internet_explorer", "version" : { "version_data" : [ { "version_value" : "10", "version_affected" : "=" }, { "version_value" : "11", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96086", "name" : "96086", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038008", "name" : "1038008", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0018", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0018", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Internet Explorer 10 and 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka \"Internet Explorer Memory Corruption Vulnerability.\" This vulnerability is different from those described in CVE-2017-0037 and CVE-2017-0149." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0019", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "word", "version" : { "version_data" : [ { "version_value" : "2016", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96042", "name" : "96042", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038010", "name" : "1038010", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0019", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0019", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Word 2016 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka \"Microsoft Office Memory Corruption Vulnerability.\" This vulnerability is different from those described in CVE-2017-0006, CVE-2017-0020, CVE-2017-0030, CVE-2017-0031, CVE-2017-0052, and CVE-2017-0053." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0020", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "excel", "version" : { "version_data" : [ { "version_value" : "2010", "version_affected" : "=" }, { "version_value" : "2013", "version_affected" : "=" }, { "version_value" : "2016", "version_affected" : "=" } ] } }, { "product_name" : "office_web_apps", "version" : { "version_data" : [ { "version_value" : "2013", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96050", "name" : "96050", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038010", "name" : "1038010", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0020", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0020", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Excel 2016, Excel 2010 SP2, Excel 2013 RT SP1, and Office Web Apps Server 2013 SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka \"Microsoft Office Memory Corruption Vulnerability.\" This vulnerability is different from those described in CVE-2017-0006, CVE-2017-0019, CVE-2017-0030, CVE-2017-0031, CVE-2017-0052, and CVE-2017-0053." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:excel:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:excel:2013:sp1:*:*:rt:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office_web_apps:2013:sp1:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0021", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96020", "name" : "96020", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037999", "name" : "1037999", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0021", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0021", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Hyper-V in Microsoft Windows 10 1607 and Windows Server 2016 does not properly validate vSMB packet data, which allows attackers to execute arbitrary code on a target OS, aka \"Hyper-V System Data Structure Vulnerability.\" This vulnerability is different from that described in CVE-2017-0095." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 9.0, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 2.3, "impactScore" : 6.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:L/Au:S/C:C/I:C/A:C", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "LOW", "authentication" : "SINGLE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.7 }, "severity" : "HIGH", "exploitabilityScore" : 5.1, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0022", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96069", "name" : "96069", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038014", "name" : "1038014", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://0patch.blogspot.com/2017/09/exploit-kit-rendezvous-and-cve-2017-0022.html", "name" : "https://0patch.blogspot.com/2017/09/exploit-kit-rendezvous-and-cve-2017-0022.html", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0022", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0022", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 and R2 SP1; Windows Server 2012 Gold and R2; Windows Server 2016; and Windows Vista SP2 improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site, aka \"Microsoft XML Information Disclosure Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-09-28T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0023", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96075", "name" : "96075", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037989", "name" : "1037989", "refsource" : "SECTRACK", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0023", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0023", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The PDF library in Microsoft Edge; Windows 8.1; Windows Server 2012 and R2; Windows RT 8.1; and Windows 10, 1511, and 1607 allows remote attackers to execute arbitrary code via a crafted PDF file, aka \"Microsoft PDF Remote Code Execution Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2018-10-17T17:07Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0024", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96029", "name" : "96029", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038017", "name" : "1038017", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0024", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0024", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The kernel-mode drivers in Microsoft Windows 10 1607 and Windows Server 2016 allow local users to gain privileges via a crafted application, aka \"Win32k Elevation of Privilege Vulnerability.\" This vulnerability is different from those described in CVE-2017-0026, CVE-2017-0056, CVE-2017-0078, CVE-2017-0079, CVE-2017-0080, CVE-2017-0081, and CVE-2017-0082." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0025", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96626", "name" : "96626", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038002", "name" : "1038002", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0025", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0025", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The kernel-mode drivers in Microsoft Windows Vista; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allow local users to gain privileges via a crafted application, aka \"Win32k Elevation of Privilege Vulnerability.\" This vulnerability is different from those described in CVE-2017-0001, CVE-2017-0005, and CVE-2017-0047." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0026", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96032", "name" : "96032", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038017", "name" : "1038017", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0026", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0026", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The kernel-mode drivers in Microsoft Windows 10 Gold, 1511, and 1607 and Windows Server 2016 allow local users to gain privileges via a crafted application, aka \"Win32k Elevation of Privilege Vulnerability.\" This vulnerability is different from those described in CVE-2017-0024, CVE-2017-0056, CVE-2017-0078, CVE-2017-0079, CVE-2017-0080, CVE-2017-0081, and CVE-2017-0082." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0027", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "excel", "version" : { "version_data" : [ { "version_value" : "2007", "version_affected" : "=" }, { "version_value" : "2010", "version_affected" : "=" }, { "version_value" : "2013", "version_affected" : "=" }, { "version_value" : "2016", "version_affected" : "=" } ] } }, { "product_name" : "office_compatibility_pack", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "sharepoint_server", "version" : { "version_data" : [ { "version_value" : "2013", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96043", "name" : "96043", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038010", "name" : "1038010", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0027", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0027", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Services on SharePoint Server 2013 SP1 allow remote attackers to obtain sensitive information from process memory via a crafted Office document, aka \"Microsoft Office Information Disclosure Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:excel:2007:sp3:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:excel:2010:sp2:*:*:*:*:x64:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:excel:2013:sp1:*:*:rt:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office_compatibility_pack:*:sp3:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:sharepoint_server:2013:sp1:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0028", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://github.com/Microsoft/ChakraCore/commit/402f3d967c0a905ec5b9ca9c240783d3f2c15724", "name" : "https://github.com/Microsoft/ChakraCore/commit/402f3d967c0a905ec5b9ca9c240783d3f2c15724", "refsource" : "CONFIRM", "tags" : [ "Patch", "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists when Microsoft scripting engine improperly accesses objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user, aka \"Scripting Engine Memory Corruption Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 9.8, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 3.9, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 10.0 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-07-17T13:18Z", "lastModifiedDate" : "2017-08-04T13:54Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0029", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "office", "version" : { "version_data" : [ { "version_value" : "2010", "version_affected" : "=" } ] } }, { "product_name" : "word", "version" : { "version_data" : [ { "version_value" : "2010", "version_affected" : "=" }, { "version_value" : "2013", "version_affected" : "=" }, { "version_value" : "2016", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96045", "name" : "96045", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038010", "name" : "1038010", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0029", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0029", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Office 2010 SP2, Word 2010 SP2, Word 2013 RT SP1, and Word 2016 allow remote attackers to cause a denial of service (application hang) via a crafted Office document, aka \"Microsoft Office Denial of Service Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word:2013:sp1:*:*:rt:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0030", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "office", "version" : { "version_data" : [ { "version_value" : "2010", "version_affected" : "=" } ] } }, { "product_name" : "office_compatibility_pack", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "office_web_apps", "version" : { "version_data" : [ { "version_value" : "2010", "version_affected" : "=" } ] } }, { "product_name" : "sharepoint_server", "version" : { "version_data" : [ { "version_value" : "2010", "version_affected" : "=" } ] } }, { "product_name" : "word", "version" : { "version_data" : [ { "version_value" : "2007", "version_affected" : "=" }, { "version_value" : "2010", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96051", "name" : "96051", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038010", "name" : "1038010", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0030", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0030", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Office 2010 SP2, Office Compatibility Pack SP3, Office Web Apps Server 2010 SP2, Word 2007 SP3, Word 2010 SP2, and Word Automation Services on SharePoint Server 2010 SP2 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka \"Microsoft Office Memory Corruption Vulnerability.\" This vulnerability is different from those described in CVE-2017-0006, CVE-2017-0019, CVE-2017-0020, CVE-2017-0031, CVE-2017-0052, and CVE-2017-0053." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office_compatibility_pack:*:sp3:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office_web_apps:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word:2007:sp3:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word:2010:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0031", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "office", "version" : { "version_data" : [ { "version_value" : "2010", "version_affected" : "=" } ] } }, { "product_name" : "office_compatibility_pack", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "word", "version" : { "version_data" : [ { "version_value" : "2007", "version_affected" : "=" }, { "version_value" : "2010", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96052", "name" : "96052", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038010", "name" : "1038010", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0031", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0031", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Office 2010 SP2, Office Compatibility Pack SP3, Word 2007 SP3, and Word 2010 SP2 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka \"Microsoft Office Memory Corruption Vulnerability.\" This vulnerability is different from those described in CVE-2017-0006, CVE-2017-0019, CVE-2017-0020, CVE-2017-0030, CVE-2017-0052, and CVE-2017-0053." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office_compatibility_pack:*:sp3:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word:2007:sp3:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word:2010:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0032", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96080", "name" : "96080", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0032", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0032", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0035, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0033", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "internet_explorer", "version" : { "version_data" : [ { "version_value" : "11", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96087", "name" : "96087", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0033", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0033", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to spoof web content via a crafted web site, aka \"Microsoft Browser Spoofing Vulnerability.\" This vulnerability is different from those described in CVE-2017-0012 and CVE-2017-0069." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0034", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96786", "name" : "96786", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0034", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0034", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0035", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96082", "name" : "96082", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0035", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0035", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0037", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "internet_explorer", "version" : { "version_data" : [ { "version_value" : "11", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-704" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96088", "name" : "96088", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037905", "name" : "1037905", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037906", "name" : "1037906", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://0patch.blogspot.si/2017/03/0patching-another-0-day-internet.html", "name" : "https://0patch.blogspot.si/2017/03/0patching-another-0-day-internet.html", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://bugs.chromium.org/p/project-zero/issues/detail?id=1011", "name" : "https://bugs.chromium.org/p/project-zero/issues/detail?id=1011", "refsource" : "MISC", "tags" : [ "Exploit", "Issue Tracking", "Third Party Advisory" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0037", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0037", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://www.exploit-db.com/exploits/41454/", "name" : "41454", "refsource" : "EXPLOIT-DB", "tags" : [ ] }, { "url" : "https://www.exploit-db.com/exploits/42354/", "name" : "42354", "refsource" : "EXPLOIT-DB", "tags" : [ ] }, { "url" : "https://www.exploit-db.com/exploits/43125/", "name" : "43125", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted Cascading Style Sheets (CSS) token sequence and crafted JavaScript code that operates on a TH element." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.1, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.2, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-02-26T23:59Z", "lastModifiedDate" : "2017-11-19T02:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0038", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96023", "name" : "96023", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037845", "name" : "1037845", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://0patch.blogspot.com/2017/02/0patching-0-day-windows-gdi32dll-memory.html", "name" : "https://0patch.blogspot.com/2017/02/0patching-0-day-windows-gdi32dll-memory.html", "refsource" : "MISC", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://bugs.chromium.org/p/project-zero/issues/detail?id=992", "name" : "https://bugs.chromium.org/p/project-zero/issues/detail?id=992", "refsource" : "MISC", "tags" : [ "Patch", "Third Party Advisory" ] }, { "url" : "https://github.com/k0keoyo/CVE-2017-0038-EXP-C-JS", "name" : "https://github.com/k0keoyo/CVE-2017-0038-EXP-C-JS", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0038", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0038", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://www.exploit-db.com/exploits/41363/", "name" : "41363", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "gdi32.dll in Graphics Device Interface (GDI) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive information from process heap memory via a crafted EMF file, as demonstrated by an EMR_SETDIBITSTODEVICE record with modified Device Independent Bitmap (DIB) dimensions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3216, CVE-2016-3219, and/or CVE-2016-3220." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-20T16:59Z", "lastModifiedDate" : "2017-09-01T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0039", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96024", "name" : "96024", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038001", "name" : "1038001", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0039", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0039", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Windows Vista SP2 and Server 2008 SP2 mishandle dynamic link library (DLL) loading, which allows local users to gain privileges via a crafted application, aka \"Library Loading Input Validation Remote Code Execution Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0040", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "internet_explorer", "version" : { "version_data" : [ { "version_value" : "9", "version_affected" : "=" }, { "version_value" : "10", "version_affected" : "=" }, { "version_value" : "11", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.security-assessment.com/files/documents/advisory/reversesegment.pdf", "name" : "http://www.security-assessment.com/files/documents/advisory/reversesegment.pdf", "refsource" : "MISC", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/96094", "name" : "96094", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038008", "name" : "1038008", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0040", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0040", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The scripting engine in Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka \"Scripting Engine Memory Corruption Vulnerability.\" This vulnerability is different from that described in CVE-2017-0130." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0042", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://pastebin.com/raw/Eztknq4s", "name" : "http://pastebin.com/raw/Eztknq4s", "refsource" : "MISC", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/96098", "name" : "96098", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038016", "name" : "1038016", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0042", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0042", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://twitter.com/Qab/status/842506404950917120", "name" : "https://twitter.com/Qab/status/842506404950917120", "refsource" : "MISC", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Windows Media Player in Microsoft Windows 8.1; Windows Server 2012 R2; Windows RT 8.1; Windows 7 SP1; Windows 2008 SP2 and R2 SP1, Windows Server 2016; Windows Vista SP2; and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive information via a crafted web site, aka \"Windows Media Player Information Disclosure Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 3.1, "baseSeverity" : "LOW" }, "exploitabilityScore" : 1.6, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0043", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96628", "name" : "96628", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038018", "name" : "1038018", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0043", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0043", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Active Directory Federation Services in Microsoft Windows 10 1607, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 Gold and R2, and Windows Server 2016 allows local users to obtain sensitive information via a crafted application, aka \"Microsoft Active Directory Federation Services Information Disclosure Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.6, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.9 }, "severity" : "LOW", "exploitabilityScore" : 5.5, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0045", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-352" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://hyp3rlinx.altervista.org/advisories/MICROSOFT-DVD-MAKER-XML-EXTERNAL-ENTITY-FILE-DISCLOSURE.txt", "name" : "http://hyp3rlinx.altervista.org/advisories/MICROSOFT-DVD-MAKER-XML-EXTERNAL-ENTITY-FILE-DISCLOSURE.txt", "refsource" : "MISC", "tags" : [ "Exploit", "Third Party Advisory" ] }, { "url" : "http://www.securityfocus.com/bid/96103", "name" : "96103", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038015", "name" : "1038015", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0045", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0045", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41619/", "name" : "41619", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Windows DVD Maker in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, and Windows Vista SP2 does not properly parse crafted .msdvd files, which allows attackers to obtain information to compromise a target system, aka \"Windows DVD Maker Cross-Site Request Forgery Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0047", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96034", "name" : "96034", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038002", "name" : "1038002", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0047", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0047", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application, aka \"Windows GDI Elevation of Privilege Vulnerability.\" This vulnerability is different from those described in CVE-2017-0001, CVE-2017-0005 and CVE-2017-0025." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0049", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "internet_explorer", "version" : { "version_data" : [ { "version_value" : "11", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96095", "name" : "96095", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038008", "name" : "1038008", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0049", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0049", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The VBScript engine in Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Scripting Engine Information Disclosure Vulnerability.\" This vulnerability is different from those described in CVE-2017-0018, and CVE-2017-0037." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0050", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96025", "name" : "96025", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038013", "name" : "1038013", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0050", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0050", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The kernel API in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7; Windows 8; Windows 10 Gold, 1511, and 1607; Windows RT 8.1; Windows Server 2012 Gold and R2; and Windows Server 2016 does not properly enforce permissions, which allows local users to spoof processes, spoof inter-process communication, or cause a denial of service via a crafted application, aka \"Windows Kernel Elevation of Privilege Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0051", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96026", "name" : "96026", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037999", "name" : "1037999", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0051", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0051", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Windows 10 1607 and Windows Server 2016 allow remote attackers to cause a denial of service (application hang) via a crafted Office document, aka \"Microsoft Hyper-V Network Switch Denial of Service Vulnerability.\" This vulnerability is different from those described in CVE-2017-0074, CVE-2017-0076, CVE-2017-0097, CVE-2017-0098, and CVE-2017-0099." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "HIGH", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.4, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 4.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 2.9 }, "severity" : "LOW", "exploitabilityScore" : 5.5, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0052", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "excel", "version" : { "version_data" : [ { "version_value" : "2007", "version_affected" : "=" } ] } }, { "product_name" : "excel_viewer", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "office_compatibility_pack", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "sharepoint_server", "version" : { "version_data" : [ { "version_value" : "2007", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96741", "name" : "96741", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038010", "name" : "1038010", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0052", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0052", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Office Compatibility Pack SP3, Excel 2007 SP3, Excel Viewer, and Excel Services on SharePoint Server 2007 SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka \"Microsoft Office Memory Corruption Vulnerability.\" This vulnerability is different from those described in CVE-2017-0006, CVE-2017-0019, CVE-2017-0020, CVE-2017-0030, CVE-2017-0031, and CVE-2017-0053." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:excel:2007:sp3:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:excel_viewer:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office_compatibility_pack:*:sp3:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:sharepoint_server:2007:sp3:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0053", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "office", "version" : { "version_data" : [ { "version_value" : "2010", "version_affected" : "=" } ] } }, { "product_name" : "office_compatibility_pack", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "word", "version" : { "version_data" : [ { "version_value" : "2007", "version_affected" : "=" }, { "version_value" : "2010", "version_affected" : "=" }, { "version_value" : "2013", "version_affected" : "=" }, { "version_value" : "2016", "version_affected" : "=" } ] } }, { "product_name" : "word_viewer", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96745", "name" : "96745", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038010", "name" : "1038010", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0053", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0053", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Office 2010 SP2, Office Compatibility Pack SP3, Word 2007 SP3, Word 2010 SP2, Word 2013 SP1, Word 2013 R2 SP1, Word 2016, and Word Viewer allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka \"Microsoft Office Memory Corruption Vulnerability.\" This vulnerability is different from those described in CVE-2017-0006, CVE-2017-0019, CVE-2017-0020, CVE-2017-0030, CVE-2017-0031, and CVE-2017-0052." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office_compatibility_pack:*:sp3:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word:2007:sp3:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word:2013:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word:2013:sp1:*:*:rt:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word_viewer:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0055", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-79" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96622", "name" : "96622", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038012", "name" : "1038012", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0055", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0055", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Internet Information Server (IIS) in Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to perform cross-site scripting and run script with local user privileges via a crafted request, aka \"Microsoft IIS Server XSS Elevation of Privilege Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "CHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 6.1, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 2.7 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0056", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96630", "name" : "96630", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038017", "name" : "1038017", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0056", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0056", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allow local users to gain privileges via a crafted application, aka \"Win32k Elevation of Privilege Vulnerability.\" This vulnerability is different from those described in CVE-2017-0024, CVE-2017-0026, CVE-2017-0078, CVE-2017-0079, CVE-2017-0080, CVE-2017-0081, CVE-2017-0082." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0057", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96695", "name" : "96695", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038001", "name" : "1038001", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0057", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0057", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "DNS client in Microsoft Windows 8.1; Windows Server 2012 R2, Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 fails to properly process DNS queries, which allows remote attackers to obtain sensitive information via (1) convincing a workstation user to visit an untrusted webpage or (2) tricking a server into sending a DNS query to a malicious DNS server, aka \"Windows DNS Query Information Disclosure Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0058", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97462", "name" : "97462", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038239", "name" : "1038239", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0058", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0058", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41879/", "name" : "41879", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A Win32k information disclosure vulnerability exists in Microsoft Windows when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system, aka \"Win32k Information Disclosure Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 1.9 }, "severity" : "LOW", "exploitabilityScore" : 3.4, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0059", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "internet_explorer", "version" : { "version_data" : [ { "version_value" : "9", "version_affected" : "=" }, { "version_value" : "10", "version_affected" : "=" }, { "version_value" : "11", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96645", "name" : "96645", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038008", "name" : "1038008", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0059", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0059", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41661/", "name" : "41661", "refsource" : "EXPLOIT-DB", "tags" : [ ] }, { "url" : "https://www.exploit-db.com/exploits/42354/", "name" : "42354", "refsource" : "EXPLOIT-DB", "tags" : [ ] }, { "url" : "https://www.exploit-db.com/exploits/43125/", "name" : "43125", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Internet Explorer Information Disclosure Vulnerability.\" This vulnerability is different from those described in CVE-2017-0008 and CVE-2017-0009." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-11-19T02:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0060", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96713", "name" : "96713", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038002", "name" : "1038002", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0060", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0060", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41656/", "name" : "41656", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"GDI+ Information Disclosure Vulnerability.\" This vulnerability is different from those described in CVE-2017-0060 and CVE-2017-0062." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 1.9 }, "severity" : "LOW", "exploitabilityScore" : 3.4, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0061", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96638", "name" : "96638", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038002", "name" : "1038002", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0061", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0061", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41657/", "name" : "41657", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Color Management Module (ICM32.dll) memory handling functionality in Windows Vista SP2, Windows Server 2008 SP2 and R2, and Windows 7 SP1 allows remote attackers to bypass ASLR and execute code in combination with another vulnerability through a crafted website, aka \"Microsoft Color Management Information Disclosure Vulnerability.\" This vulnerability is different from that described in CVE-2017-0063." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.6, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0062", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96715", "name" : "96715", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038002", "name" : "1038002", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0062", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0062", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41658/", "name" : "41658", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"GDI+ Information Disclosure Vulnerability.\" This vulnerability is different from those described in CVE-2017-0060 and CVE-2017-0073." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 1.9 }, "severity" : "LOW", "exploitabilityScore" : 3.4, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0063", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96643", "name" : "96643", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038002", "name" : "1038002", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0063", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0063", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41659/", "name" : "41659", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Color Management Module (ICM32.dll) memory handling functionality in Windows Vista SP2; Windows Server 2008 SP2 and R2; and Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to bypass ASLR and execute code in combination with another vulnerability through a crafted website, aka \"Microsoft Color Management Information Disclosure Vulnerability.\" This vulnerability is different from that described in CVE-2017-0061." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 6.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0064", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "internet_explorer", "version" : { "version_data" : [ { "version_value" : "9", "version_affected" : "=" }, { "version_value" : "10", "version_affected" : "=" }, { "version_value" : "11", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98121", "name" : "98121", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038447", "name" : "1038447", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0064", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0064", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A security feature bypass vulnerability exists in Internet Explorer that allows for bypassing Mixed Content warnings, aka \"Internet Explorer Security Feature Bypass Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "availabilityImpact" : "NONE", "baseScore" : 6.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0065", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96648", "name" : "96648", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0065", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0065", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Edge allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Microsoft Browser Information Disclosure Vulnerability.\" This vulnerability is different from those described in CVE-2017-0009, CVE-2017-0011, CVE-2017-0017, and CVE-2017-0068." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0066", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96655", "name" : "96655", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0066", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0066", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Edge allows remote attackers to bypass the Same Origin Policy for HTML elements in other browser windows, aka \"Microsoft Edge Security Feature Bypass Vulnerability.\" This vulnerability is different from those described in CVE-2017-0135 and CVE-2017-0140." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 4.2, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.6, "impactScore" : 2.5 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 4.9, "impactScore" : 4.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0067", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96662", "name" : "96662", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0067", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0067", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0035, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0068", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96649", "name" : "96649", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0068", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0068", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Browsers in Microsoft Edge allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Microsoft Edge Information Disclosure Vulnerability.\" This vulnerability is different from those described in CVE-2017-0009, CVE-2017-0011, CVE-2017-0017, and CVE-2017-0065." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0069", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96650", "name" : "96650", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0069", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0069", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Edge allows remote attackers to spoof web content via a crafted web site, aka \"Microsoft Edge Spoofing Vulnerability.\" This vulnerability is different from those described in CVE-2017-0012 and CVE-2017-0033." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0070", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-416" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96690", "name" : "96690", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0070", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0070", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41623/", "name" : "41623", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0035, CVE-2017-0067, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0071", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96681", "name" : "96681", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0071", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0071", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0035, CVE-2017-0067, CVE-2017-0070, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0072", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96599", "name" : "96599", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0072", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0072", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41654/", "name" : "41654", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted web site, aka \"Uniscribe Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0083, CVE-2017-0084, CVE-2017-0086, CVE-2017-0087, CVE-2017-0088, CVE-2017-0089, and CVE-2017-0090." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0073", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96637", "name" : "96637", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038002", "name" : "1038002", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0073", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0073", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Windows GDI+ Information Disclosure Vulnerability.\" This vulnerability is different from those described in CVE-2017-0060 and CVE-2017-0062." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0074", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96641", "name" : "96641", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037999", "name" : "1037999", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0074", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0074", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and 2008 R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 and R2; Windows 10, 1511, and 1607; and Windows Server 2016 allows guest OS users, running as virtual machines, to cause a denial of service via a crafted application, aka \"Hyper-V Denial of Service Vulnerability.\" This vulnerability is different from those described in CVE-2017-0098, CVE-2017-0076, CVE-2017-0097, and CVE-2017-0099." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "HIGH", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.4, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 4.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:M/Au:S/C:N/I:N/A:P", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 2.3 }, "severity" : "LOW", "exploitabilityScore" : 4.4, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0075", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96698", "name" : "96698", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037999", "name" : "1037999", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0075", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0075", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows guest OS users to execute arbitrary code on the host OS via a crafted application, aka \"Hyper-V Remote Code Execution Vulnerability.\" This vulnerability is different from that described in CVE-2017-0109." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "HIGH", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.6, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 6.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:M/Au:S/C:C/I:C/A:C", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.4 }, "severity" : "HIGH", "exploitabilityScore" : 4.4, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0076", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96636", "name" : "96636", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037999", "name" : "1037999", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0076", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0076", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and 2008 R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 and R2; Windows 10, 1511, and 1607; and Windows Server 2016 allows guest OS users, running as virtual machines, to cause a denial of service via a crafted application, aka \"Hyper-V Denial of Service Vulnerability.\" This vulnerability is different from those described in CVE-2017-0098, CVE-2017-0074, CVE-2017-0097, and CVE-2017-0099." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "HIGH", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.4, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 4.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 2.9 }, "severity" : "LOW", "exploitabilityScore" : 5.5, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0077", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98114", "name" : "98114", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038454", "name" : "1038454", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0077", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0077", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The kernel-mode drivers in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow a local authenticated attacker to execute a specially crafted application to obtain information, or in Windows 7 and later, cause denial of service, aka \"Win32k Information Disclosure Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0078", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96631", "name" : "96631", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038017", "name" : "1038017", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0078", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0078", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The kernel-mode drivers in Microsoft Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allow local users to gain privileges via a crafted application, aka \"Win32k Elevation of Privilege Vulnerability.\" This vulnerability is different from those described in CVE-2017-0024, CVE-2017-0026, CVE-2017-0056, CVE-2017-0079, CVE-2017-0080, CVE-2017-0081, CVE-2017-0082." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0079", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "r2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96632", "name" : "96632", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038017", "name" : "1038017", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0079", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0079", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The kernel-mode drivers in Windows 8.1; Windows Server 2012 R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka \"Win32k Elevation of Privilege Vulnerability.\" This vulnerability is different from those described in CVE-2017-0024, CVE-2017-0026, CVE-2017-0056, CVE-2017-0078, CVE-2017-0080, CVE-2017-0081, and CVE-2017-0082." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0080", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96633", "name" : "96633", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038017", "name" : "1038017", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0080", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0080", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The kernel-mode drivers in Microsoft Windows 10 Gold, 1511, and 1607 and Windows Server 2016 allow local users to gain privileges via a crafted application, aka \"Win32k Elevation of Privilege Vulnerability.\" This vulnerability is different from those described in CVE-2017-0024, CVE-2017-0026, CVE-2017-0056, CVE-2017-0078, CVE-2017-0079, CVE-2017-0081, and CVE-2017-0082." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0081", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96634", "name" : "96634", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038017", "name" : "1038017", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0081", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0081", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The kernel-mode drivers in Microsoft Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allow local users to gain privileges via a crafted application, aka \"Win32k Elevation of Privilege Vulnerability.\" This vulnerability is different from those described in CVE-2017-0024, CVE-2017-0026, CVE-2017-0056, CVE-2017-0078, CVE-2017-0079, CVE-2017-0080, CVE-2017-0082." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0082", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96635", "name" : "96635", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038017", "name" : "1038017", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0082", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0082", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The kernel-mode drivers in Microsoft Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application, aka \"Win32k Elevation of Privilege Vulnerability.\" This vulnerability is different from those described in CVE-2017-0024, CVE-2017-0026, CVE-2017-0056, CVE-2017-0078, CVE-2017-0079, CVE-2017-0080, and CVE-2017-0081." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0083", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96608", "name" : "96608", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0083", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0083", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41655/", "name" : "41655", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted web site, aka \"Uniscribe Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0072, CVE-2017-0084, CVE-2017-0086, CVE-2017-0087, CVE-2017-0088, CVE-2017-0089, and CVE-2017-0090." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0084", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96610", "name" : "96610", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0084", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0084", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41648/", "name" : "41648", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to execute arbitrary code via a crafted web site, aka \"Windows Uniscribe Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0072, CVE-2017-0083, CVE-2017-0086, CVE-2017-0087, CVE-2017-0088, CVE-2017-0089, and CVE-2017-0090." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:gold:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0085", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96652", "name" : "96652", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0085", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0085", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41646/", "name" : "41646", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Uniscribe Information Disclosure Vulnerability.\" CVE-2017-0091, CVE-2017-0092, CVE-2017-0111, CVE-2017-0112, CVE-2017-0113, CVE-2017-0114, CVE-2017-0115, CVE-2017-0116, CVE-2017-0117, CVE-2017-0118, CVE-2017-0119, CVE-2017-0120, CVE-2017-0121, CVE-2017-0122, CVE-2017-0123, CVE-2017-0124, CVE-2017-0125, CVE-2017-0126, CVE-2017-0127, and CVE-2017-0128." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0086", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96603", "name" : "96603", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0086", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0086", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41649/", "name" : "41649", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted web site, aka \"Uniscribe Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0072, CVE-2017-0083, CVE-2017-0084, CVE-2017-0087, CVE-2017-0088, CVE-2017-0089, and CVE-2017-0090." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0087", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96604", "name" : "96604", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0087", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0087", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41650/", "name" : "41650", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted web site, aka \"Uniscribe Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0072, CVE-2017-0083, CVE-2017-0084, CVE-2017-0086, CVE-2017-0088, CVE-2017-0089, and CVE-2017-0090." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0088", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96605", "name" : "96605", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0088", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0088", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41651/", "name" : "41651", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted web site, aka \"Windows Uniscribe Remote Code Execution Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0089", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96606", "name" : "96606", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0089", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0089", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41652/", "name" : "41652", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted web site, aka \"Uniscribe Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0072, CVE-2017-0083, CVE-2017-0084, CVE-2017-0086, CVE-2017-0087, CVE-2017-0088, and CVE-2017-0090." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0090", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96607", "name" : "96607", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0090", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0090", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41653/", "name" : "41653", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted web site, aka \"Uniscribe Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0072, CVE-2017-0083, CVE-2017-0084, CVE-2017-0086, CVE-2017-0087, CVE-2017-0088, and CVE-2017-0089." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0091", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96657", "name" : "96657", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0091", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0091", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41655/", "name" : "41655", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Uniscribe Information Disclosure Vulnerability.\" CVE-2017-0085, CVE-2017-0092, CVE-2017-0111, CVE-2017-0112, CVE-2017-0113, CVE-2017-0114, CVE-2017-0115, CVE-2017-0116, CVE-2017-0117, CVE-2017-0118, CVE-2017-0119, CVE-2017-0120, CVE-2017-0121, CVE-2017-0122, CVE-2017-0123, CVE-2017-0124, CVE-2017-0125, CVE-2017-0126, CVE-2017-0127, and CVE-2017-0128." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0092", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96676", "name" : "96676", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0092", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0092", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41655/", "name" : "41655", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Uniscribe Information Disclosure Vulnerability.\" CVE-2017-0085, CVE-2017-0091, CVE-2017-0111, CVE-2017-0112, CVE-2017-0113, CVE-2017-0114, CVE-2017-0115, CVE-2017-0116, CVE-2017-0117, CVE-2017-0118, CVE-2017-0119, CVE-2017-0120, CVE-2017-0121, CVE-2017-0122, CVE-2017-0123, CVE-2017-0124, CVE-2017-0125, CVE-2017-0126, CVE-2017-0127, and CVE-2017-0128." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0093", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97419", "name" : "97419", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038234", "name" : "1038234", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0093", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0093", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in Microsoft Edge exists in the way that the Scripting Engine renders when handling objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user, aka \"Scripting Engine Memory Corruption Vulnerability.\" This CVE ID is unique from CVE-2017-0201." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0094", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96682", "name" : "96682", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0094", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0094", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0035, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0095", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96699", "name" : "96699", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037999", "name" : "1037999", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0095", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0095", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Hyper-V in Microsoft Windows 10 Gold, 1511, and 1607 and Windows Server 2016 does not properly validate vSMB packet data, which allows attackers to execute arbitrary code on a target OS, aka \"Hyper-V vSMB Remote Code Execution Vulnerability.\" This vulnerability is different from that described in CVE-2017-0021." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "HIGH", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.6, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 6.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.9 }, "severity" : "HIGH", "exploitabilityScore" : 5.5, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0096", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96701", "name" : "96701", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037999", "name" : "1037999", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0096", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0096", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1, Windows Server 2012 Gold and R2; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows guest OS users to obtain sensitive information from host OS memory via a crafted application, aka \"Hyper-V Information Disclosure Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "HIGH", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6, "baseSeverity" : "LOW" }, "exploitabilityScore" : 1.0, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:M/Au:S/C:P/I:N/A:N", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.3 }, "severity" : "LOW", "exploitabilityScore" : 4.4, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0097", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96639", "name" : "96639", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037999", "name" : "1037999", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0097", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0097", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and 2008 R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 and R2; Windows 10, 1511, and 1607; and Windows Server 2016 allows guest OS users, running as virtual machines, to cause a denial of service via a crafted application, aka \"Hyper-V Denial of Service Vulnerability.\" This vulnerability is different from those described in CVE-2017-0098, CVE-2017-0074, CVE-2017-0076, and CVE-2017-0099." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "HIGH", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.4, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 4.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:M/Au:S/C:N/I:N/A:P", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 2.3 }, "severity" : "LOW", "exploitabilityScore" : 4.4, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0098", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96642", "name" : "96642", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037999", "name" : "1037999", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0098", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0098", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Hyper-V in Microsoft Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows guest OS users, running as virtual machines, to cause a denial of service via a crafted application, aka \"Hyper-V Denial of Service Vulnerability.\" This vulnerability is different from those described in CVE-2017-0074, CVE-2017-0076, CVE-2017-0097, and CVE-2017-0099." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "HIGH", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.4, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 4.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 2.9 }, "severity" : "LOW", "exploitabilityScore" : 5.5, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0099", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96640", "name" : "96640", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037999", "name" : "1037999", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0099", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0099", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and 2008 R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows guest OS users, running as virtual machines, to cause a denial of service via a crafted application, aka \"Hyper-V Denial of Service Vulnerability.\" This vulnerability is different from those described in CVE-2017-0098, CVE-2017-0074, CVE-2017-0076, and CVE-2017-0097." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "HIGH", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.4, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 4.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:M/Au:S/C:N/I:N/A:P", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 2.3 }, "severity" : "LOW", "exploitabilityScore" : 4.4, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0100", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-287" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://blog.inspired-sec.com/archive/2017/03/17/COM-Moniker-Privesc.html", "name" : "http://blog.inspired-sec.com/archive/2017/03/17/COM-Moniker-Privesc.html", "refsource" : "MISC", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/96700", "name" : "96700", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038001", "name" : "1038001", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://bugs.chromium.org/p/project-zero/issues/detail?id=1021", "name" : "https://bugs.chromium.org/p/project-zero/issues/detail?id=1021", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0100", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0100", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41607/", "name" : "41607", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A DCOM object in Helppane.exe in Microsoft Windows 7 SP1; Windows Server 2008 R2; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows local users to gain privileges via a crafted application, aka \"Windows HelpPane Elevation of Privilege Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 4.4 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.4, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0101", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96625", "name" : "96625", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038013", "name" : "1038013", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0101", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0101", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/44479/", "name" : "44479", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The kernel-mode drivers in Transaction Manager in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allow local users to gain privileges via a crafted application, aka \"Windows Elevation of Privilege Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2018-04-19T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0102", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96627", "name" : "96627", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038013", "name" : "1038013", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0102", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0102", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 let attackers with access to targets systems gain privileges when Windows fails to properly validate buffer lengths, aka \"Windows Elevation of Privilege Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 4.6 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.9, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0103", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96623", "name" : "96623", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038013", "name" : "1038013", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0103", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0103", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41645/", "name" : "41645", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The kernel API in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Windows Server 2012 mishandles registry objects in memory, which allows local users to gain privileges via a crafted application, aka \"Windows Registry Elevation of Privilege Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 4.4 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.4, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0104", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-190" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96697", "name" : "96697", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038001", "name" : "1038001", "refsource" : "SECTRACK", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0104", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0104", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The iSNS Server service in Microsoft Windows Server 2008 SP2 and R2, Windows Server 2012 Gold and R2, and Windows Server 2016 allows remote attackers to issue malicious requests via an integer overflow, aka \"iSNS Server Memory Corruption Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.1, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.2, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2018-10-30T16:28Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0105", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "office", "version" : { "version_data" : [ { "version_value" : "2010", "version_affected" : "=" } ] } }, { "product_name" : "office_compatibility_pack", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "office_web_apps", "version" : { "version_data" : [ { "version_value" : "2010", "version_affected" : "=" } ] } }, { "product_name" : "sharepoint_server", "version" : { "version_data" : [ { "version_value" : "2010", "version_affected" : "=" } ] } }, { "product_name" : "word", "version" : { "version_data" : [ { "version_value" : "2007", "version_affected" : "=" } ] } }, { "product_name" : "word_automation_services", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "word_for_mac", "version" : { "version_data" : [ { "version_value" : "2011", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96746", "name" : "96746", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038010", "name" : "1038010", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0105", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0105", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps 2010 SP2 allow remote attackers to obtain sensitive information from out-of-bound memory via a crafted Office document, aka \"Microsoft Office Information Disclosure Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office_web_apps:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word:2007:sp3:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word_automation_services:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word_for_mac:2011:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0106", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "outlook", "version" : { "version_data" : [ { "version_value" : "2007", "version_affected" : "=" }, { "version_value" : "2010", "version_affected" : "=" }, { "version_value" : "2013", "version_affected" : "=" }, { "version_value" : "2016", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97413", "name" : "97413", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038227", "name" : "1038227", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0106", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0106", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Excel 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1, and Microsoft Outlook 2016 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka \"Microsoft Office Memory Corruption Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:outlook:2007:sp3:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:outlook:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0107", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "sharepoint_foundation", "version" : { "version_data" : [ { "version_value" : "2013", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-79" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96748", "name" : "96748", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038019", "name" : "1038019", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0107", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0107", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft SharePoint Server fails to sanitize crafted web requests, allowing remote attackers to run cross-script in local security context, aka \"Microsoft SharePoint XSS Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "CHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 6.1, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 2.7 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0108", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "live_meeting", "version" : { "version_data" : [ { "version_value" : "2007", "version_affected" : "=" } ] } }, { "product_name" : "lync", "version" : { "version_data" : [ { "version_value" : "2010", "version_affected" : "=" }, { "version_value" : "2013", "version_affected" : "=" } ] } }, { "product_name" : "office", "version" : { "version_data" : [ { "version_value" : "2007", "version_affected" : "=" }, { "version_value" : "2010", "version_affected" : "=" } ] } }, { "product_name" : "silverlight", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" } ] } }, { "product_name" : "skype_for_business", "version" : { "version_data" : [ { "version_value" : "2016", "version_affected" : "=" } ] } }, { "product_name" : "word_viewer", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96722", "name" : "96722", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038002", "name" : "1038002", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0108", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0108", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41647/", "name" : "41647", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Windows Graphics Component in Microsoft Office 2007 SP3; 2010 SP2; and Word Viewer; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Live Meeting 2007; Silverlight 5; Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted web site, aka \"Graphics Component Remote Code Execution Vulnerability.\" This vulnerability is different from that described in CVE-2017-0014." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:live_meeting:2007:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:lync:2010:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:lync:2013:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:silverlight:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:skype_for_business:2016:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word_viewer:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0109", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96644", "name" : "96644", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037999", "name" : "1037999", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0109", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0109", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Hyper-V in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows guest OS users to execute arbitrary code on the host OS via a crafted application, aka \"Hyper-V Remote Code Execution Vulnerability.\" This vulnerability is different from that described in CVE-2017-0075." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "HIGH", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.6, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 6.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:M/Au:S/C:C/I:C/A:C", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.4 }, "severity" : "HIGH", "exploitabilityScore" : 4.4, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0110", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "exchange_server", "version" : { "version_data" : [ { "version_value" : "2013", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-79" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96621", "name" : "96621", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038011", "name" : "1038011", "refsource" : "SECTRACK", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0110", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0110", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Cross-site scripting (XSS) vulnerability in Microsoft Exchange Outlook Web Access (OWA) allows remote attackers to inject arbitrary web script or HTML via a crafted email or chat client, aka \"Microsoft Exchange Server Elevation of Privilege Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_14:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:exchange_server:2013:cumulative_update_3:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:exchange_server:2013:sp1:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "CHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 6.1, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 2.7 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2018-08-09T16:41Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0111", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96658", "name" : "96658", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0111", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0111", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41655/", "name" : "41655", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Uniscribe Information Disclosure Vulnerability.\" CVE-2017-0085, CVE-2017-0091, CVE-2017-0092, CVE-2017-0112, CVE-2017-0113, CVE-2017-0114, CVE-2017-0115, CVE-2017-0116, CVE-2017-0117, CVE-2017-0118, CVE-2017-0119, CVE-2017-0120, CVE-2017-0121, CVE-2017-0122, CVE-2017-0123, CVE-2017-0124, CVE-2017-0125, CVE-2017-0126, CVE-2017-0127, and CVE-2017-0128." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0112", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96659", "name" : "96659", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0112", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0112", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41655/", "name" : "41655", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Uniscribe Information Disclosure Vulnerability.\" CVE-2017-0085, CVE-2017-0091, CVE-2017-0092, CVE-2017-0111, CVE-2017-0113, CVE-2017-0114, CVE-2017-0115, CVE-2017-0116, CVE-2017-0117, CVE-2017-0118, CVE-2017-0119, CVE-2017-0120, CVE-2017-0121, CVE-2017-0122, CVE-2017-0123, CVE-2017-0124, CVE-2017-0125, CVE-2017-0126, CVE-2017-0127, and CVE-2017-0128." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0113", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96660", "name" : "96660", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0113", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0113", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41655/", "name" : "41655", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Uniscribe Information Disclosure Vulnerability.\" CVE-2017-0085, CVE-2017-0091, CVE-2017-0092, CVE-2017-0111, CVE-2017-0112, CVE-2017-0114, CVE-2017-0115, CVE-2017-0116, CVE-2017-0117, CVE-2017-0118, CVE-2017-0119, CVE-2017-0120, CVE-2017-0121, CVE-2017-0122, CVE-2017-0123, CVE-2017-0124, CVE-2017-0125, CVE-2017-0126, CVE-2017-0127, and CVE-2017-0128." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0114", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96661", "name" : "96661", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0114", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0114", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41655/", "name" : "41655", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Uniscribe Information Disclosure Vulnerability.\" CVE-2017-0085, CVE-2017-0091, CVE-2017-0092, CVE-2017-0111, CVE-2017-0112, CVE-2017-0113, CVE-2017-0115, CVE-2017-0116, CVE-2017-0117, CVE-2017-0118, CVE-2017-0119, CVE-2017-0120, CVE-2017-0121, CVE-2017-0122, CVE-2017-0123, CVE-2017-0124, CVE-2017-0125, CVE-2017-0126, CVE-2017-0127, and CVE-2017-0128." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0115", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96663", "name" : "96663", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0115", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0115", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41655/", "name" : "41655", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Uniscribe Information Disclosure Vulnerability.\" CVE-2017-0085, CVE-2017-0091, CVE-2017-0092, CVE-2017-0111, CVE-2017-0112, CVE-2017-0113, CVE-2017-0114, CVE-2017-0116, CVE-2017-0117, CVE-2017-0118, CVE-2017-0119, CVE-2017-0120, CVE-2017-0121, CVE-2017-0122, CVE-2017-0123, CVE-2017-0124, CVE-2017-0125, CVE-2017-0126, CVE-2017-0127, and CVE-2017-0128." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0116", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96665", "name" : "96665", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0116", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0116", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41655/", "name" : "41655", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Uniscribe Information Disclosure Vulnerability.\" CVE-2017-0085, CVE-2017-0091, CVE-2017-0092, CVE-2017-0111, CVE-2017-0112, CVE-2017-0113, CVE-2017-0114, CVE-2017-0115, CVE-2017-0117, CVE-2017-0118, CVE-2017-0119, CVE-2017-0120, CVE-2017-0121, CVE-2017-0122, CVE-2017-0123, CVE-2017-0124, CVE-2017-0125, CVE-2017-0126, CVE-2017-0127, and CVE-2017-0128." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0117", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96679", "name" : "96679", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0117", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0117", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41655/", "name" : "41655", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Uniscribe Information Disclosure Vulnerability.\" CVE-2017-0085, CVE-2017-0091, CVE-2017-0092, CVE-2017-0111, CVE-2017-0112, CVE-2017-0113, CVE-2017-0114, CVE-2017-0115, CVE-2017-0117, CVE-2017-0118, CVE-2017-0119, CVE-2017-0120, CVE-2017-0121, CVE-2017-0122, CVE-2017-0123, CVE-2017-0124, CVE-2017-0125, CVE-2017-0126, CVE-2017-0127, and CVE-2017-0128." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0118", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96680", "name" : "96680", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0118", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0118", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41655/", "name" : "41655", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Uniscribe Information Disclosure Vulnerability.\" CVE-2017-0085, CVE-2017-0091, CVE-2017-0092, CVE-2017-0111, CVE-2017-0112, CVE-2017-0113, CVE-2017-0114, CVE-2017-0115, CVE-2017-0116, CVE-2017-0117, CVE-2017-0119, CVE-2017-0120, CVE-2017-0121, CVE-2017-0122, CVE-2017-0123, CVE-2017-0124, CVE-2017-0125, CVE-2017-0126, CVE-2017-0127, and CVE-2017-0128." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0119", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96666", "name" : "96666", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0119", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0119", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41655/", "name" : "41655", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Uniscribe Information Disclosure Vulnerability.\" CVE-2017-0085, CVE-2017-0091, CVE-2017-0092, CVE-2017-0111, CVE-2017-0112, CVE-2017-0113, CVE-2017-0114, CVE-2017-0115, CVE-2017-0116, CVE-2017-0117, CVE-2017-0118, CVE-2017-0120, CVE-2017-0121, CVE-2017-0122, CVE-2017-0123, CVE-2017-0124, CVE-2017-0125, CVE-2017-0126, CVE-2017-0127, and CVE-2017-0128." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0120", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96667", "name" : "96667", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0120", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0120", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41655/", "name" : "41655", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Windows Uniscribe Information Disclosure Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0121", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96678", "name" : "96678", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0121", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0121", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41655/", "name" : "41655", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Uniscribe Information Disclosure Vulnerability.\" CVE-2017-0085, CVE-2017-0091, CVE-2017-0092, CVE-2017-0111, CVE-2017-0112, CVE-2017-0113, CVE-2017-0114, CVE-2017-0115, CVE-2017-0116, CVE-2017-0117, CVE-2017-0118, CVE-2017-0119, CVE-2017-0120, CVE-2017-0122, CVE-2017-0123, CVE-2017-0124, CVE-2017-0125, CVE-2017-0126, CVE-2017-0127, and CVE-2017-0128." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0122", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96668", "name" : "96668", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0122", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0122", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41655/", "name" : "41655", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Uniscribe Information Disclosure Vulnerability.\" CVE-2017-0085, CVE-2017-0091, CVE-2017-0092, CVE-2017-0111, CVE-2017-0112, CVE-2017-0113, CVE-2017-0114, CVE-2017-0115, CVE-2017-0116, CVE-2017-0117, CVE-2017-0118, CVE-2017-0119, CVE-2017-0120, CVE-2017-0121, CVE-2017-0123, CVE-2017-0124, CVE-2017-0125, CVE-2017-0126, CVE-2017-0127, and CVE-2017-0128." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0123", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96669", "name" : "96669", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0123", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0123", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41655/", "name" : "41655", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Uniscribe Information Disclosure Vulnerability.\" CVE-2017-0085, CVE-2017-0091, CVE-2017-0092, CVE-2017-0111, CVE-2017-0112, CVE-2017-0113, CVE-2017-0114, CVE-2017-0115, CVE-2017-0116, CVE-2017-0117, CVE-2017-0118, CVE-2017-0119, CVE-2017-0120, CVE-2017-0121, CVE-2017-0122, CVE-2017-0124, CVE-2017-0125, CVE-2017-0126, CVE-2017-0127, and CVE-2017-0128." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0124", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96670", "name" : "96670", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0124", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0124", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41655/", "name" : "41655", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Uniscribe Information Disclosure Vulnerability.\" CVE-2017-0085, CVE-2017-0091, CVE-2017-0092, CVE-2017-0111, CVE-2017-0112, CVE-2017-0113, CVE-2017-0114, CVE-2017-0115, CVE-2017-0116, CVE-2017-0117, CVE-2017-0118, CVE-2017-0119, CVE-2017-0120, CVE-2017-0121, CVE-2017-0122, CVE-2017-0123, CVE-2017-0124, CVE-2017-0126, CVE-2017-0127, and CVE-2017-0128." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0125", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96672", "name" : "96672", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0125", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0125", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41655/", "name" : "41655", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Uniscribe Information Disclosure Vulnerability.\" CVE-2017-0085, CVE-2017-0091, CVE-2017-0092, CVE-2017-0111, CVE-2017-0112, CVE-2017-0113, CVE-2017-0114, CVE-2017-0115, CVE-2017-0116, CVE-2017-0117, CVE-2017-0118, CVE-2017-0119, CVE-2017-0120, CVE-2017-0121, CVE-2017-0122, CVE-2017-0123, CVE-2017-0124, CVE-2017-0126, CVE-2017-0127, and CVE-2017-0128." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0126", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96673", "name" : "96673", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0126", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0126", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41655/", "name" : "41655", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Uniscribe Information Disclosure Vulnerability.\" CVE-2017-0085, CVE-2017-0091, CVE-2017-0092, CVE-2017-0111, CVE-2017-0112, CVE-2017-0113, CVE-2017-0114, CVE-2017-0115, CVE-2017-0116, CVE-2017-0117, CVE-2017-0118, CVE-2017-0119, CVE-2017-0120, CVE-2017-0121, CVE-2017-0122, CVE-2017-0123, CVE-2017-0124, CVE-2017-0125, CVE-2017-0127, and CVE-2017-0128." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0127", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96674", "name" : "96674", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0127", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0127", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41655/", "name" : "41655", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Uniscribe Information Disclosure Vulnerability.\" CVE-2017-0085, CVE-2017-0091, CVE-2017-0092, CVE-2017-0111, CVE-2017-0112, CVE-2017-0113, CVE-2017-0114, CVE-2017-0115, CVE-2017-0116, CVE-2017-0117, CVE-2017-0118, CVE-2017-0119, CVE-2017-0120, CVE-2017-0121, CVE-2017-0122, CVE-2017-0123, CVE-2017-0124, CVE-2017-0125, CVE-2017-0126, and CVE-2017-0128." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0128", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96675", "name" : "96675", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037992", "name" : "1037992", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0128", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0128", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41655/", "name" : "41655", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Uniscribe Information Disclosure Vulnerability.\" CVE-2017-0085, CVE-2017-0091, CVE-2017-0092, CVE-2017-0111, CVE-2017-0112, CVE-2017-0113, CVE-2017-0114, CVE-2017-0115, CVE-2017-0116, CVE-2017-0117, CVE-2017-0118, CVE-2017-0119, CVE-2017-0120, CVE-2017-0121, CVE-2017-0122, CVE-2017-0123, CVE-2017-0124, CVE-2017-0125, CVE-2017-0126, and CVE-2017-0127." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0129", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "lync_for_mac", "version" : { "version_data" : [ { "version_value" : "2011", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-295" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96752", "name" : "96752", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038020", "name" : "1038020", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0129", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0129", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Lync for Mac 2011 fails to properly validate certificates, allowing remote attackers to alter server-client communications, aka \"Microsoft Lync for Mac Certificate Validation Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:lync_for_mac:2011:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "availabilityImpact" : "NONE", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "acInsufInfo" : true, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0130", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "internet_explorer", "version" : { "version_data" : [ { "version_value" : "9", "version_affected" : "=" }, { "version_value" : "10", "version_affected" : "=" }, { "version_value" : "11", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96647", "name" : "96647", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038008", "name" : "1038008", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0130", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0130", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The scripting engine in Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka \"Scripting Engine Memory Corruption Vulnerability.\" This vulnerability is different from that described in CVE-2017-0040." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0131", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96671", "name" : "96671", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0131", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0131", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0035, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0132", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96686", "name" : "96686", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0132", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0132", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0035, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0133, CVE-2017-0134, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0133", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96683", "name" : "96683", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0133", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0133", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0035, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0134, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0134", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96687", "name" : "96687", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0134", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0134", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0035, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0135", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96656", "name" : "96656", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://medium.com/bugbountywriteup/bypass-csp-by-abusing-xss-filter-in-edge-43e9106a9754", "name" : "https://medium.com/bugbountywriteup/bypass-csp-by-abusing-xss-filter-in-edge-43e9106a9754", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0135", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0135", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.freebuf.com/articles/web/164871.html", "name" : "https://www.freebuf.com/articles/web/164871.html", "refsource" : "MISC", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Edge allows remote attackers to bypass the Same Origin Policy for HTML elements in other browser windows, aka \"Microsoft Edge Security Feature Bypass Vulnerability.\" This vulnerability is different from those described in CVE-2017-0066 and CVE-2017-0140." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 4.2, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.6, "impactScore" : 2.5 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 4.9, "impactScore" : 4.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0136", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96688", "name" : "96688", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0136", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0136", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0035, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0137", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96689", "name" : "96689", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0137", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0137", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0035, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0136, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0138", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96684", "name" : "96684", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0138", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0138", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0035, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0136, CVE-2017-0137, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0140", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96653", "name" : "96653", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0140", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0140", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Edge allows remote attackers to bypass the Same Origin Policy for HTML elements in other browser windows, aka \"Microsoft Edge Security Feature Bypass Vulnerability.\" This vulnerability is different from those described in CVE-2017-0066 and CVE-2017-0135." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 4.2, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.6, "impactScore" : 2.5 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 4.9, "impactScore" : 4.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0141", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96685", "name" : "96685", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0141", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0141", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0035, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0150, and CVE-2017-0151." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0143", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "server_message_block", "version" : { "version_data" : [ { "version_value" : "1.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html", "name" : "http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html", "refsource" : "MISC", "tags" : [ ] }, { "url" : "http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html", "name" : "http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html", "refsource" : "MISC", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/96703", "name" : "96703", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037991", "name" : "1037991", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf", "name" : "https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf", "name" : "https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "name" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0143", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0143", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41891/", "name" : "41891", "refsource" : "EXPLOIT-DB", "tags" : [ ] }, { "url" : "https://www.exploit-db.com/exploits/41987/", "name" : "41987", "refsource" : "EXPLOIT-DB", "tags" : [ ] }, { "url" : "https://www.exploit-db.com/exploits/43970/", "name" : "43970", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0144, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:server_message_block:1.0:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:gold:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.1, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.2, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2018-06-21T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0144", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "server_message_block", "version" : { "version_data" : [ { "version_value" : "1.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html", "name" : "http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html", "refsource" : "MISC", "tags" : [ ] }, { "url" : "http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html", "name" : "http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html", "refsource" : "MISC", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/96704", "name" : "96704", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037991", "name" : "1037991", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf", "name" : "https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf", "name" : "https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "name" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0144", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0144", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41891/", "name" : "41891", "refsource" : "EXPLOIT-DB", "tags" : [ ] }, { "url" : "https://www.exploit-db.com/exploits/41987/", "name" : "41987", "refsource" : "EXPLOIT-DB", "tags" : [ ] }, { "url" : "https://www.exploit-db.com/exploits/42030/", "name" : "42030", "refsource" : "EXPLOIT-DB", "tags" : [ ] }, { "url" : "https://www.exploit-db.com/exploits/42031/", "name" : "42031", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:server_message_block:1.0:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:gold:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.1, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.2, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2018-06-21T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0145", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "server_message_block", "version" : { "version_data" : [ { "version_value" : "1.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html", "name" : "http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html", "refsource" : "MISC", "tags" : [ ] }, { "url" : "http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html", "name" : "http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html", "refsource" : "MISC", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/96705", "name" : "96705", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037991", "name" : "1037991", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf", "name" : "https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf", "name" : "https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "name" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0145", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0145", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41891/", "name" : "41891", "refsource" : "EXPLOIT-DB", "tags" : [ ] }, { "url" : "https://www.exploit-db.com/exploits/41987/", "name" : "41987", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0146, and CVE-2017-0148." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:server_message_block:1.0:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:gold:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.1, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.2, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2018-06-21T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0146", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "server_message_block", "version" : { "version_data" : [ { "version_value" : "1.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html", "name" : "http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html", "refsource" : "MISC", "tags" : [ ] }, { "url" : "http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html", "name" : "http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html", "refsource" : "MISC", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/96707", "name" : "96707", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037991", "name" : "1037991", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf", "name" : "https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf", "name" : "https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "name" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0146", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0146", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41891/", "name" : "41891", "refsource" : "EXPLOIT-DB", "tags" : [ ] }, { "url" : "https://www.exploit-db.com/exploits/41987/", "name" : "41987", "refsource" : "EXPLOIT-DB", "tags" : [ ] }, { "url" : "https://www.exploit-db.com/exploits/43970/", "name" : "43970", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0148." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:server_message_block:1.0:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:gold:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.1, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.2, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2018-06-21T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0147", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "server_message_block", "version" : { "version_data" : [ { "version_value" : "1.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html", "name" : "http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html", "refsource" : "MISC", "tags" : [ ] }, { "url" : "http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html", "name" : "http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html", "refsource" : "MISC", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/96709", "name" : "96709", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037991", "name" : "1037991", "refsource" : "SECTRACK", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf", "name" : "https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf", "name" : "https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "name" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0147", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0147", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41891/", "name" : "41891", "refsource" : "EXPLOIT-DB", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://www.exploit-db.com/exploits/41987/", "name" : "41987", "refsource" : "EXPLOIT-DB", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://www.exploit-db.com/exploits/43970/", "name" : "43970", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted packets, aka \"Windows SMB Information Disclosure Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:server_message_block:1.0:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:gold:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.9, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.2, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2018-06-21T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0148", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "server_message_block", "version" : { "version_data" : [ { "version_value" : "1.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html", "name" : "http://packetstormsecurity.com/files/154690/DOUBLEPULSAR-Payload-Execution-Neutralization.html", "refsource" : "MISC", "tags" : [ ] }, { "url" : "http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html", "name" : "http://packetstormsecurity.com/files/156196/SMB-DOUBLEPULSAR-Remote-Code-Execution.html", "refsource" : "MISC", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/96706", "name" : "96706", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037991", "name" : "1037991", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf", "name" : "https://cert-portal.siemens.com/productcert/pdf/ssa-701903.pdf", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf", "name" : "https://cert-portal.siemens.com/productcert/pdf/ssa-966341.pdf", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "name" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0148", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0148", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41891/", "name" : "41891", "refsource" : "EXPLOIT-DB", "tags" : [ ] }, { "url" : "https://www.exploit-db.com/exploits/41987/", "name" : "41987", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka \"Windows SMB Remote Code Execution Vulnerability.\" This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0145, and CVE-2017-0146." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:server_message_block:1.0:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:gold:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.1, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.2, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2018-06-21T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0149", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "internet_explorer", "version" : { "version_data" : [ { "version_value" : "9", "version_affected" : "=" }, { "version_value" : "10", "version_affected" : "=" }, { "version_value" : "11", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96724", "name" : "96724", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038008", "name" : "1038008", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0149", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0149", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka \"Internet Explorer Memory Corruption Vulnerability.\" This vulnerability is different from those described in CVE-2017-0018 and CVE-2017-0037." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0150", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96725", "name" : "96725", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0150", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0150", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0035, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, and CVE-2017-0151." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0151", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96727", "name" : "96727", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038006", "name" : "1038006", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0151", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0151", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0035, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, and CVE-2017-0150." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0152", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://github.com/Microsoft/ChakraCore/commit/9da019424601325a6e95e6be0fa03d7d21d0b517", "name" : "https://github.com/Microsoft/ChakraCore/commit/9da019424601325a6e95e6be0fa03d7d21d0b517", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in the way affected Microsoft scripting engine render when handling objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user, aka \"Scripting Engine Memory Corruption Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.1, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.2, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-07-17T13:18Z", "lastModifiedDate" : "2017-07-21T16:27Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0154", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "internet_explorer", "version" : { "version_data" : [ { "version_value" : "11", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-74" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96766", "name" : "96766", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038008", "name" : "1038008", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0154", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0154", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Internet Explorer 11 on Windows 10, 1511, and 1606 and Windows Server 2016 does not enforce cross-domain policies, allowing attackers to access information from one domain and inject it into another via a crafted application, aka, \"Internet Explorer Elevation of Privilege Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 4.4, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 2.5 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 5.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 4.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-17T00:59Z", "lastModifiedDate" : "2017-07-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0155", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97471", "name" : "97471", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038237", "name" : "1038237", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0155", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0155", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Graphics component in the kernel in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; and Windows 7 SP1 allows local users to gain privileges via a crafted application, aka \"Windows Graphics Elevation of Privilege Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 6.9 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.4, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0156", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97507", "name" : "97507", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038237", "name" : "1038237", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0156", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0156", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability exists in Windows 7, Windows 8.1, Windows RT 8.1, Windows 10, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 when the Microsoft Graphics Component fails to properly handle objects in memory, aka \"Windows Graphics Component Elevation of Privilege Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 6.9 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.4, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0158", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97455", "name" : "97455", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038238", "name" : "1038238", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0158", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0158", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability exists when Microsoft Windows running on Windows 10, Windows 10 1511, Windows 8.1 Windows RT 8.1, and Windows Server 2012 R2 fails to properly sanitize handles in memory, aka \"Scripting Engine Memory Corruption Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0159", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97449", "name" : "97449", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038243", "name" : "1038243", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0159", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0159", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A security feature bypass vulnerability exists in Windows 10 1607, Windows Server 2012 R2, and Windows 2016 when ADFS incorrectly treats requests coming from Extranet clients as Intranet requests, aka \"ADFS Security Feature Bypass Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 3.7, "baseSeverity" : "LOW" }, "exploitabilityScore" : 2.2, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0160", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : ".net_framework", "version" : { "version_data" : [ { "version_value" : "2.0", "version_affected" : "=" }, { "version_value" : "3.5", "version_affected" : "=" }, { "version_value" : "3.5.1", "version_affected" : "=" }, { "version_value" : "4.5.2", "version_affected" : "=" }, { "version_value" : "4.6", "version_affected" : "=" }, { "version_value" : "4.6.1", "version_affected" : "=" }, { "version_value" : "4.6.2", "version_affected" : "=" }, { "version_value" : "4.7", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97447", "name" : "97447", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038236", "name" : "1038236", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0160", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0160", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41903/", "name" : "41903", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft .NET Framework 2.0, 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allows an attacker with access to the local system to execute malicious code, aka \".NET Remote Code Execution Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:.net_framework:4.5.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:.net_framework:4.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:.net_framework:4.6.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0161", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-362" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100728", "name" : "100728", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1039318", "name" : "1039318", "refsource" : "SECTRACK", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0161", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0161", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Windows NetBT Session Services component on Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a remote code execution vulnerability when it fails to maintain certain sequencing requirements, aka \"NetBIOS Remote Code Execution Vulnerability\"." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.1, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.2, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-09-13T01:29Z", "lastModifiedDate" : "2017-09-21T17:10Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0162", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97461", "name" : "97461", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038233", "name" : "1038233", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0162", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0162", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists when Windows Hyper-V Network Switch running on a Windows 10, Windows 8.1, Windows Server 2012 R2, or Windows Server 2016 host server fails to properly validate input from an authenticated user on a guest operating system, aka \"Hyper-V Remote Code Execution Vulnerability.\" This CVE ID is unique from CVE-2017-0163, CVE-2017-0180, and CVE-2017-0181." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "HIGH", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.6, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 6.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:M/Au:S/C:C/I:C/A:C", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.4 }, "severity" : "HIGH", "exploitabilityScore" : 4.4, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0163", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97465", "name" : "97465", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038233", "name" : "1038233", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0163", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0163", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists when Windows Hyper-V Network Switch running on a host server fails to properly validate input from an authenticated user on a guest operating system, aka \"Hyper-V Remote Code Execution Vulnerability.\" This CVE ID is unique from CVE-2017-0162, CVE-2017-0180, and CVE-2017-0181." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "HIGH", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.6, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 6.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:M/Au:S/C:C/I:C/A:C", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.4 }, "severity" : "HIGH", "exploitabilityScore" : 4.4, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0164", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97448", "name" : "97448", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038235", "name" : "1038235", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0164", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0164", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability exists in Windows 10 1607 and Windows Server 2016 Active Directory when an authenticated attacker sends malicious search queries, aka \"Active Directory Denial of Service Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "HIGH", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 4.4, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 0.7, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:S/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 3.5 }, "severity" : "LOW", "exploitabilityScore" : 6.8, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0165", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "r2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97467", "name" : "97467", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038239", "name" : "1038239", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0165", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0165", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41901/", "name" : "41901", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability exists when Microsoft Windows running on Windows 10, Windows 10 1511, Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2 fails to properly sanitize handles in memory, aka \"Windows Elevation of Privilege Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0166", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-131" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97446", "name" : "97446", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038245", "name" : "1038245", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0166", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0166", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability exists in Windows when LDAP request buffer lengths are improperly calculated. In a remote attack scenario, an attacker could exploit this vulnerability by running a specially crafted application to send malicious traffic to a Domain Controller, aka \"LDAP Elevation of Privilege Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:x64:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:x86:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.1, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.2, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0167", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97473", "name" : "97473", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038239", "name" : "1038239", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0167", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0167", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41880/", "name" : "41880", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability exists in Windows 8.1, Windows RT 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 when the Windows kernel improperly handles objects in memory. An attacker who successfully exploited this vulnerability could obtain information to further compromise the user's system, a.k.a. \"Windows Kernel Information Disclosure Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:P/I:N/A:N", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.1 }, "severity" : "LOW", "exploitabilityScore" : 3.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0168", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97418", "name" : "97418", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038232", "name" : "1038232", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0168", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0168", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability exists when the Windows Hyper-V Network Switch running on a Windows 8.1, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, or Windows Server 2012 R2 host operating system fails to properly validate input from an authenticated user on a guest operating system, aka \"Hyper-V Information Disclosure Vulnerability.\" This CVE ID is unique from CVE-2017-0169." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "HIGH", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.8, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.3, "impactScore" : 4.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:S/C:C/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 6.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 6.8, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0169", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97459", "name" : "97459", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038232", "name" : "1038232", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0169", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0169", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability exists when Windows Hyper-V running on a Windows 8.1, Windows Server 2012. or Windows Server 2012 R2 host operating system fails to properly validate input from an authenticated user on a guest operating system, aka \"Hyper-V Information Disclosure Vulnerability.\" This CVE ID is unique from CVE-2017-0168." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "HIGH", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.4, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 4.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:M/Au:S/C:C/I:N/A:N", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.2 }, "severity" : "MEDIUM", "exploitabilityScore" : 4.4, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0170", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-611" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99398", "name" : "99398", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038855", "name" : "1038855", "refsource" : "SECTRACK", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-0170", "name" : "https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-0170", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Windows Performance Monitor in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an information disclosure vulnerability due to the way it parses XML input, aka \"Windows Performance Monitor Information Disclosure Vulnerability\"." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 6.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-11T21:29Z", "lastModifiedDate" : "2017-09-27T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0171", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98097", "name" : "98097", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0171", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0171", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Windows DNS Server allows a denial of service vulnerability when Microsoft Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 Gold and R2, and Windows Server 2016 are configured to answer version queries, aka \"Windows DNS Server Denial of Service Vulnerability\"." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.9, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.2, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-05-25T15:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0173", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98873", "name" : "98873", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0173", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0173", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Windows 10 1607 and Windows Server 2016 allow an attacker to exploit a security feature bypass vulnerability in Device Guard that could allow the attacker to inject malicious code into a Windows PowerShell session, aka \"Device Guard Code Integrity Policy Security Feature Bypass Vulnerability.\" This CVE ID is unique from CVE-2017-0215, CVE-2017-0216, CVE-2017-0218, and CVE-2017-0219." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "LOW", "baseScore" : 5.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 4.6 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.9, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-06-15T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0174", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100038", "name" : "100038", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1039109", "name" : "1039109", "refsource" : "SECTRACK", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0174", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0174", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Windows NetBIOS in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows a denial of service vulnerability when it improperly handles NetBIOS packets, aka \"Windows NetBIOS Denial of Service Vulnerability\"." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 6.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:L/Au:N/C:N/I:N/A:C", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 6.1 }, "severity" : "MEDIUM", "exploitabilityScore" : 6.5, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-08-08T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0175", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98110", "name" : "98110", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038452", "name" : "1038452", "refsource" : "SECTRACK", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0175", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0175", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/42009/", "name" : "42009", "refsource" : "EXPLOIT-DB", "tags" : [ "Third Party Advisory", "VDB Entry" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Windows kernel in Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows authenticated attackers to obtain sensitive information via a specially crafted document, aka \"Windows Kernel Information Disclosure Vulnerability,\" a different vulnerability than CVE-2017-0220, CVE-2017-0258, and CVE-2017-0259." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:P/I:N/A:N", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.1 }, "severity" : "LOW", "exploitabilityScore" : 3.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2018-10-30T16:28Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0176", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_server_2003", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_xp", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-120" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98550", "name" : "98550", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securityfocus.com/bid/98752", "name" : "98752", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://blog.0patch.com/2017/06/a-quick-analysis-of-microsofts.html", "name" : "https://blog.0patch.com/2017/06/a-quick-analysis-of-microsofts.html", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://blog.fortinet.com/2017/05/11/deep-analysis-of-esteemaudit", "name" : "https://blog.fortinet.com/2017/05/11/deep-analysis-of-esteemaudit", "refsource" : "MISC", "tags" : [ "Exploit", "Third Party Advisory" ] }, { "url" : "https://blogs.technet.microsoft.com/msrc/2017/04/14/protecting-customers-and-evaluating-risk/", "name" : "https://blogs.technet.microsoft.com/msrc/2017/04/14/protecting-customers-and-evaluating-risk/", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://support.microsoft.com/en-us/help/4022747/security-update-for-windows-xp-and-windows-server-2003", "name" : "https://support.microsoft.com/en-us/help/4022747/security-update-for-windows-xp-and-windows-server-2003", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A buffer overflow in Smart Card authentication code in gpkcsp.dll in Microsoft Windows XP through SP3 and Server 2003 through SP2 allows a remote attacker to execute arbitrary code on the target computer, provided that the computer is joined in a Windows domain and has Remote Desktop Protocol connectivity (or Terminal Services) enabled." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2003:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_xp:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_xp:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_xp:*:sp3:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.1, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.2, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-06-22T14:29Z", "lastModifiedDate" : "2019-10-24T15:15Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0178", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97416", "name" : "97416", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0178", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0178", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability exists when Microsoft Hyper-V running on Windows 10, Windows 10 1511, Windows 10 1607, Windows 8.1, Windows Server 2012 R2, and Windows Server 2016 host server fails to properly validate input from a privileged user on a guest operating system, aka \"Hyper-V Denial of Service Vulnerability.\" This CVE ID is unique from CVE-2017-0179, CVE-2017-0182, CVE-2017-0183, CVE-2017-0184, CVE-2017-0185, and CVE-2017-0186." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "HIGH", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.4, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 4.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:M/Au:S/C:N/I:N/A:C", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 5.2 }, "severity" : "MEDIUM", "exploitabilityScore" : 4.4, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-04-18T16:37Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0179", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97426", "name" : "97426", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0179", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0179", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability exists when Microsoft Hyper-V running on a Windows 10, Windows 8.1, Windows Server 2012 R2, or Windows Server 2016 host server fails to properly validate input from a privileged user on a guest operating system, aka \"Hyper-V Denial of Service Vulnerability.\" This CVE ID is unique from CVE-2017-0178, CVE-2017-0182, CVE-2017-0183, CVE-2017-0184, CVE-2017-0185, and CVE-2017-0186." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "HIGH", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.8, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.3, "impactScore" : 4.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:S/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 6.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 6.8, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-04-18T16:55Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0180", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97444", "name" : "97444", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038233", "name" : "1038233", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0180", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0180", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists when Windows Hyper-V Network Switch running on a host server fails to properly validate input from an authenticated user on a guest operating system, aka \"Hyper-V Remote Code Execution Vulnerability.\" This CVE ID is unique from CVE-2017-0162, CVE-2017-0163, and CVE-2017-0181." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "HIGH", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.6, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 6.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:M/Au:S/C:C/I:C/A:C", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.4 }, "severity" : "HIGH", "exploitabilityScore" : 4.4, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0181", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97445", "name" : "97445", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038233", "name" : "1038233", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0181", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0181", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists when Windows Hyper-V Network Switch running on a Windows 10 or Windows Server 2016 host server fails to properly validate input from an authenticated user on a guest operating system, aka \"Hyper-V Remote Code Execution Vulnerability.\" This CVE ID is unique from CVE-2017-0162, CVE-2017-0163, and CVE-2017-0180." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "HIGH", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.6, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 6.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:M/Au:S/C:C/I:C/A:C", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.4 }, "severity" : "HIGH", "exploitabilityScore" : 4.4, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0182", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97427", "name" : "97427", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0182", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0182", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability exists when Microsoft Hyper-V Network Switch running on a Windows 10, Windows Server 2008 R2, Windows 8.1, Windows Server 2012 R2, or Windows Server 2016 host server fails to properly validate input from a privileged user on a guest operating system, aka \"Hyper-V Denial of Service Vulnerability.\" This CVE ID is unique from CVE-2017-0178, CVE-2017-0179, CVE-2017-0183, CVE-2017-0184, CVE-2017-0185, and CVE-2017-0186." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "HIGH", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.8, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.3, "impactScore" : 4.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:S/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 6.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 6.8, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-04-18T16:54Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0183", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97428", "name" : "97428", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0183", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0183", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability exists when Microsoft Hyper-V Network Switch running on a Windows 10, Windows Server 2008 R2, Windows 8.1, Windows Server 2012 R2, or Windows Server 2016 host server fails to properly validate input from a privileged user on a guest operating system, aka \"Hyper-V Denial of Service Vulnerability.\" This CVE ID is unique from CVE-2017-0178, CVE-2017-0179, CVE-2017-0182, CVE-2017-0184, CVE-2017-0185, and CVE-2017-0186." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "HIGH", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.8, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.3, "impactScore" : 4.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:S/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 6.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 6.8, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-04-18T16:54Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0184", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97435", "name" : "97435", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0184", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0184", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability exists when Microsoft Hyper-V running on a host server fails to properly validate input from a privileged user on a guest operating system, aka \"Hyper-V Denial of Service Vulnerability.\" This CVE ID is unique from CVE-2017-0178, CVE-2017-0179, CVE-2017-0182, CVE-2017-0183, CVE-2017-0185, and CVE-2017-0186." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "HIGH", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.4, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 4.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:M/Au:S/C:N/I:N/A:C", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 5.2 }, "severity" : "MEDIUM", "exploitabilityScore" : 4.4, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-04-18T16:36Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0185", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97437", "name" : "97437", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038230", "name" : "1038230", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0185", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0185", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability exists when Microsoft Hyper-V Network Switch running on a Windows 10, Windows 8.1, Windows Server 2012, Windows Server 2012 R2, or Windows Server 2016 host server fails to properly validate input from a privileged user on a guest operating system, aka \"Hyper-V Denial of Service Vulnerability.\" This CVE ID is unique from CVE-2017-0178, CVE-2017-0179, CVE-2017-0182, CVE-2017-0183, CVE-2017-0184, and CVE-2017-0186." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "HIGH", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.8, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.3, "impactScore" : 4.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:S/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 6.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 6.8, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0186", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97438", "name" : "97438", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0186", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0186", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability exists when Microsoft Hyper-V Network Switch running on a Windows 10, Windows 8.1, Windows Server 2012, Windows Server 2012 R2, or Windows Server 2016 host server fails to properly validate input from a privileged user on a guest operating system, aka \"Hyper-V Denial of Service Vulnerability.\" This CVE ID is unique from CVE-2017-0178, CVE-2017-0179, CVE-2017-0182, CVE-2017-0183, CVE-2017-0184, and CVE-2017-0185." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "HIGH", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.8, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.3, "impactScore" : 4.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:S/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 6.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 6.8, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-04-18T16:53Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0188", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97475", "name" : "97475", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038239", "name" : "1038239", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0188", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0188", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A Win32k information disclosure vulnerability exists in Windows 8.1, Windows RT 8.1, Windows Server 2012, Windows Server 2012 R2, Windows 10, and Windows Server 2016 when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system, aka \"Win32k Information Disclosure Vulnerability.\" This CVE ID is unique from CVE-2017-0189." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 3.3, "baseSeverity" : "LOW" }, "exploitabilityScore" : 1.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:P/I:N/A:N", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.1 }, "severity" : "LOW", "exploitabilityScore" : 3.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0189", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97420", "name" : "97420", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038239", "name" : "1038239", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0189", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0189", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability exists in Windows 10 when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode, aka \"Win32k Elevation of Privilege Vulnerability.\" This CVE ID is unique from CVE-2017-0188." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0190", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98298", "name" : "98298", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038451", "name" : "1038451", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0190", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0190", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The GDI component in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"GDI Information Disclosure Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "HIGH", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.4, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 0.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:P/I:N/A:N", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.1 }, "severity" : "LOW", "exploitabilityScore" : 3.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-07-08T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0191", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97466", "name" : "97466", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038239", "name" : "1038239", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0191", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0191", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability exists in the way that Windows 7, Windows 8.1, Windows 10, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 handles objects in memory. An attacker who successfully exploited the vulnerability could cause a target system to stop responding, aka \"Windows Denial of Service Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "HIGH", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.8, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.3, "impactScore" : 4.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:S/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 3.5 }, "severity" : "LOW", "exploitabilityScore" : 6.8, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0192", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97452", "name" : "97452", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038231", "name" : "1038231", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0192", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0192", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Adobe Type Manager Font Driver (ATMFD.dll) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold , 1511, 1607, and 1703 allows an attacker to gain sensitive information via a specially crafted document or an untrusted website, aka \"ATMFD.dll Information Disclosure Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0193", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "rt", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-755" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98878", "name" : "98878", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038670", "name" : "1038670", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0193", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0193", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Windows Hyper-V in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to gain elevated privileges on a target guest operating system when Windows Hyper-V instruction emulation fails to properly enforce privilege levels, aka \"Hypervisor Code Integrity Elevation of Privilege Vulnerability\"." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:rt:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 4.6 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.9, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-06-15T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0194", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "excel", "version" : { "version_data" : [ { "version_value" : "2007", "version_affected" : "=" }, { "version_value" : "2010", "version_affected" : "=" } ] } }, { "product_name" : "office_compatibility_pack", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97436", "name" : "97436", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038244", "name" : "1038244", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0194", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0194", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Excel 2007 SP3, Microsoft Excel 2010 SP2, and Office Compatibility Pack SP2 allow remote attackers to obtain sensitive information from process memory via a crafted Office document, aka \"Microsoft Office Information Disclosure Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:excel:2007:sp3:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:excel:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office_compatibility_pack:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0195", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "excel_web_app", "version" : { "version_data" : [ { "version_value" : "2010", "version_affected" : "=" } ] } }, { "product_name" : "office_online_server", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "office_web_apps", "version" : { "version_data" : [ { "version_value" : "2010", "version_affected" : "=" } ] } }, { "product_name" : "office_web_apps_server", "version" : { "version_data" : [ { "version_value" : "2013", "version_affected" : "=" } ] } }, { "product_name" : "sharepoint_server", "version" : { "version_data" : [ { "version_value" : "2010", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-79" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97417", "name" : "97417", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0195", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0195", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Excel Services on Microsoft SharePoint Server 2010 SP1 and SP2, Microsoft Excel Web Apps 2010 SP2, Microsoft Office Web Apps 2010 SP2, Microsoft Office Web Apps Server 2013 SP1 and Office Online Server allows remote attackers to perform cross-site scripting and run script with local user privileges via a crafted request, aka \"Microsoft Office XSS Elevation of Privilege Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:excel_web_app:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office_web_apps:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office_web_apps_server:2013:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:sharepoint_server:2010:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "REQUIRED", "scope" : "CHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 5.4, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.3, "impactScore" : 2.7 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:S/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 3.5 }, "severity" : "LOW", "exploitabilityScore" : 6.8, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-04-20T18:20Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0196", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://github.com/Microsoft/ChakraCore/commit/065b7978c40ded35c356ced6cd922a40156c9c46", "name" : "https://github.com/Microsoft/ChakraCore/commit/065b7978c40ded35c356ced6cd922a40156c9c46", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in Microsoft scripting engine allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka \"Microsoft Browser Information Disclosure Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 6.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-17T13:18Z", "lastModifiedDate" : "2017-07-21T16:23Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0197", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "onenote", "version" : { "version_data" : [ { "version_value" : "2007", "version_affected" : "=" }, { "version_value" : "2010", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97411", "name" : "97411", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038241", "name" : "1038241", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0197", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0197", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://twitter.com/buffaloverflow/status/852937040480149505", "name" : "https://twitter.com/buffaloverflow/status/852937040480149505", "refsource" : "MISC", "tags" : [ "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft OneNote 2007 SP3 and Microsoft OneNote 2010 SP2 allow remote attackers to execute arbitrary code via a crafted document, aka \"Microsoft Office DLL Loading Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:onenote:2007:sp3:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:onenote:2010:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0199", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "office", "version" : { "version_data" : [ { "version_value" : "2007", "version_affected" : "=" }, { "version_value" : "2010", "version_affected" : "=" }, { "version_value" : "2013", "version_affected" : "=" }, { "version_value" : "2016", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_vista", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://rewtin.blogspot.nl/2017/04/cve-2017-0199-practical-exploitation-poc.html", "name" : "http://rewtin.blogspot.nl/2017/04/cve-2017-0199-practical-exploitation-poc.html", "refsource" : "MISC", "tags" : [ "Exploit", "Third Party Advisory" ] }, { "url" : "http://www.securityfocus.com/bid/97498", "name" : "97498", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038224", "name" : "1038224", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://blog.nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document/", "name" : "https://blog.nviso.be/2017/04/12/analysis-of-a-cve-2017-0199-malicious-rtf-document/", "refsource" : "MISC", "tags" : [ "Exploit", "Third Party Advisory" ] }, { "url" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "name" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0199", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41894/", "name" : "41894", "refsource" : "EXPLOIT-DB", "tags" : [ ] }, { "url" : "https://www.exploit-db.com/exploits/41934/", "name" : "41934", "refsource" : "EXPLOIT-DB", "tags" : [ ] }, { "url" : "https://www.exploit-db.com/exploits/42995/", "name" : "42995", "refsource" : "EXPLOIT-DB", "tags" : [ ] }, { "url" : "https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html", "name" : "https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html", "refsource" : "MISC", "tags" : [ "Exploit", "Third Party Advisory" ] }, { "url" : "https://www.mdsec.co.uk/2017/04/exploiting-cve-2017-0199-hta-handler-vulnerability/", "name" : "https://www.mdsec.co.uk/2017/04/exploiting-cve-2017-0199-hta-handler-vulnerability/", "refsource" : "MISC", "tags" : [ "Exploit", "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote attackers to execute arbitrary code via a crafted document, aka \"Microsoft Office/WordPad Remote Code Execution Vulnerability w/Windows API.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0200", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97456", "name" : "97456", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038234", "name" : "1038234", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0200", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0200", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user, aka \"Microsoft Edge Memory Corruption Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0201", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "internet_explorer", "version" : { "version_data" : [ { "version_value" : "9", "version_affected" : "=" }, { "version_value" : "10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97454", "name" : "97454", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038238", "name" : "1038238", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0201", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0201", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in Internet Explorer in the way that the JScript and VBScript engines render when handling objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user, aka \"Scripting Engine Memory Corruption Vulnerability.\" This CVE ID is unique from CVE-2017-0093." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0202", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "internet_explorer", "version" : { "version_data" : [ { "version_value" : "11", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97441", "name" : "97441", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038238", "name" : "1038238", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0202", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0202", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41941/", "name" : "41941", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user, a.k.a. \"Internet Explorer Memory Corruption Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-08-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0203", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97443", "name" : "97443", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038234", "name" : "1038234", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0203", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0203", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A vulnerability exists in Microsoft Edge when the Edge Content Security Policy (CSP) fails to properly validate certain specially crafted documents. An attacker could trick a user into loading a web page with malicious content, aka \"Microsoft Edge Security Feature Bypass Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0204", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "outlook", "version" : { "version_data" : [ { "version_value" : "2007", "version_affected" : "=" }, { "version_value" : "2010", "version_affected" : "=" }, { "version_value" : "2013", "version_affected" : "=" }, { "version_value" : "2016", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97458", "name" : "97458", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038227", "name" : "1038227", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0204", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0204", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Outlook 2007 SP3, Microsoft Outlook 2010 SP2, Microsoft Outlook 2013 SP1, and Microsoft Outlook 2016 allow remote attackers to bypass the Office Protected View via a specially crafted document, aka \"Microsoft Office Security Feature Bypass Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:outlook:2007:sp3:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:outlook:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0205", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97442", "name" : "97442", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038234", "name" : "1038234", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0205", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0205", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user, aka \"Microsoft Edge Memory Corruption Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0207", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "outlook", "version" : { "version_data" : [ { "version_value" : "2011", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97463", "name" : "97463", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038242", "name" : "1038242", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0207", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0207", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Outlook for Mac 2011 allows remote attackers to spoof web content via a crafted email with specific HTML tags, aka \"Microsoft Browser Spoofing Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:outlook:2011:*:*:*:*:mac_os_x:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "availabilityImpact" : "NONE", "baseScore" : 6.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0208", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97460", "name" : "97460", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038234", "name" : "1038234", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0208", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0208", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability exists in Microsoft Edge when the Chakra scripting engine does not properly handle objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system, a.k.a. \"Scripting Engine Information Disclosure Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0210", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "internet_explorer", "version" : { "version_data" : [ { "version_value" : "10", "version_affected" : "=" }, { "version_value" : "11", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97512", "name" : "97512", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038238", "name" : "1038238", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0210", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0210", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information from one domain and inject it into another domain, aka \"Internet Explorer Elevation of Privilege Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0211", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-610" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97514", "name" : "97514", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038240", "name" : "1038240", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0211", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0211", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41902/", "name" : "41902", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability exists in Windows 10, Windows 8.1, Windows RT 8.1, Windows Server 2012, Windows Server 2012 R2, and Windows Server 2016 versions of Microsoft Windows OLE when it fails an integrity-level check, aka \"Windows OLE Elevation of Privilege Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-12T14:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0212", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98099", "name" : "98099", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0212", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0212", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Windows Hyper-V allows an elevation of privilege vulnerability when Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 fail to properly validate vSMB packet data, aka \"Windows Hyper-V vSMB Elevation of Privilege Vulnerability\"." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "HIGH", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.6, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 6.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 5.4 }, "severity" : "MEDIUM", "exploitabilityScore" : 5.5, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0213", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98102", "name" : "98102", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038457", "name" : "1038457", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0213", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0213", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/42020/", "name" : "42020", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation privilege vulnerability when an attacker runs a specially crafted application, aka \"Windows COM Elevation of Privilege Vulnerability\". This CVE ID is unique from CVE-2017-0214." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:N/I:P/A:N", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 1.9 }, "severity" : "LOW", "exploitabilityScore" : 3.4, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0214", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98103", "name" : "98103", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0214", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0214", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/42021/", "name" : "42021", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Windows COM in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation privilege vulnerability when Windows fails to properly validate input before loading type libraries, aka \"Windows COM Elevation of Privilege Vulnerability\". This CVE ID is unique from CVE-2017-0213." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 4.4 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.4, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0215", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-668" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98879", "name" : "98879", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038669", "name" : "1038669", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0215", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0215", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] }, { "url" : "https://posts.specterops.io/umci-bypass-using-psworkflowutility-cve-2017-0215-71c76c1588f9", "name" : "https://posts.specterops.io/umci-bypass-using-psworkflowutility-cve-2017-0215-71c76c1588f9", "refsource" : "MISC", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Windows 10 1607 and Windows Server 2016 allow an attacker to exploit a security feature bypass vulnerability in Device Guard that could allow the attacker to inject malicious code into a Windows PowerShell session, aka \"Device Guard Code Integrity Policy Security Feature Bypass Vulnerability.\" This CVE ID is unique from CVE-2017-0173, CVE-2017-0216, CVE-2017-0218, and CVE-2017-0219." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "LOW", "baseScore" : 5.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 4.6 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.9, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-06-15T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0216", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98896", "name" : "98896", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0216", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0216", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Windows 10 1511, Windows 10 1607, and Windows Server 2016 allow an attacker to exploit a security feature bypass vulnerability in Device Guard that could allow the attacker to inject malicious code into a Windows PowerShell session, aka \"Device Guard Code Integrity Policy Security Feature Bypass Vulnerability.\" This CVE ID is unique from CVE-2017-0173, CVE-2017-0215, CVE-2017-0218, and CVE-2017-0219." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "LOW", "baseScore" : 5.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 4.6 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.9, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-06-15T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0218", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98897", "name" : "98897", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038669", "name" : "1038669", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0218", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0218", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Windows 10 Gold, Windows 10 1511, Windows 10 1607, and Windows Server 2016 allow an attacker to exploit a security feature bypass vulnerability in Device Guard that could allow the attacker to inject malicious code into a Windows PowerShell session, aka \"Device Guard Code Integrity Policy Security Feature Bypass Vulnerability.\" This CVE ID is unique from CVE-2017-0173, CVE-2017-0215, CVE-2017-0216, and CVE-2017-0219." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "LOW", "baseScore" : 5.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 4.6 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.9, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-06-15T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0219", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98898", "name" : "98898", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0219", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0219", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Windows 10 Gold, Windows 10 1511, Windows 10 1607, and Windows Server 2016 allow an attacker to exploit a security feature bypass vulnerability in Device Guard that could allow the attacker to inject malicious code into a Windows PowerShell session, aka \"Device Guard Code Integrity Policy Security Feature Bypass Vulnerability.\" This CVE ID is unique from CVE-2017-0173, CVE-2017-0215, CVE-2017-0216, and CVE-2017-0218." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "LOW", "baseScore" : 5.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 4.6 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.9, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-06-15T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0220", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98111", "name" : "98111", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038445", "name" : "1038445", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0220", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0220", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/42009/", "name" : "42009", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Windows kernel in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Windows Server 2012 Gold allows authenticated attackers to obtain sensitive information via a specially crafted document, aka \"Windows Kernel Information Disclosure Vulnerability,\" a different vulnerability than CVE-2017-0175, CVE-2017-0258, and CVE-2017-0259." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 1.9 }, "severity" : "LOW", "exploitabilityScore" : 3.4, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-08-13T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0221", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98147", "name" : "98147", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0221", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0221", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka \"Microsoft Edge Memory Corruption Vulnerability.\" This CVE ID is unique from CVE-2017-0227 and CVE-2017-0240." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-05-23T19:17Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0222", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "internet_explorer", "version" : { "version_data" : [ { "version_value" : "10", "version_affected" : "=" }, { "version_value" : "11", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98127", "name" : "98127", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038423", "name" : "1038423", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0222", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0222", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka \"Internet Explorer Memory Corruption Vulnerability.\" This CVE ID is unique from CVE-2017-0226." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-07-08T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0223", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securitytracker.com/id/1038425", "name" : "1038425", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://github.com/Microsoft/ChakraCore/pull/2959", "name" : "https://github.com/Microsoft/ChakraCore/pull/2959", "refsource" : "CONFIRM", "tags" : [ "Patch", "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in Microsoft Chakra Core in the way JavaScript engines render when handling objects in memory. aka \"Scripting Engine Memory Corruption Vulnerability\". This vulnerability is unique from CVE-2017-0252." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 9.8, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 3.9, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 7.5 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.4, "acInsufInfo" : true, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-15T17:29Z", "lastModifiedDate" : "2017-07-08T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0224", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98214", "name" : "98214", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0224", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0224", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in the way JavaScript engines render when handling objects in memory in Microsoft Edge, aka \"Scripting Engine Memory Corruption Vulnerability.\" This CVE ID is unique from CVE-2017-0228, CVE-2017-0229, CVE-2017-0230, CVE-2017-0234, CVE-2017-0235, CVE-2017-0236, and CVE-2017-0238." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-05-23T17:42Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0226", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "internet_explorer", "version" : { "version_data" : [ { "version_value" : "10", "version_affected" : "=" }, { "version_value" : "11", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98139", "name" : "98139", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0226", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0226", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka \"Internet Explorer Memory Corruption Vulnerability.\" This CVE ID is unique from CVE-2017-0222." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-05-23T18:05Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0227", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98281", "name" : "98281", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038424", "name" : "1038424", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0227", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0227", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in Microsoft Edge in the way affected Microsoft scripting engines render when handling objects in memory, aka \"Microsoft Edge Memory Corruption Vulnerability.\" This CVE ID is unique from CVE-2017-0221 and CVE-2017-0240." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-07-08T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0228", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "internet_explorer", "version" : { "version_data" : [ { "version_value" : "11", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98164", "name" : "98164", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038425", "name" : "1038425", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038426", "name" : "1038426", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0228", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0228", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in Microsoft browsers in the way JavaScript engines render when handling objects in memory, aka \"Scripting Engine Memory Corruption Vulnerability.\" This CVE ID is unique from CVE-2017-0224, CVE-2017-0229, CVE-2017-0230, CVE-2017-0234, CVE-2017-0235, CVE-2017-0236, and CVE-2017-0238." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-07-08T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0229", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98217", "name" : "98217", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0229", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0229", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in Microsoft Edge in the way JavaScript engines render when handling objects in memory, aka \"Scripting Engine Memory Corruption Vulnerability.\" This CVE ID is unique from CVE-2017-0224, CVE-2017-0228, CVE-2017-0230, CVE-2017-0234, CVE-2017-0235, CVE-2017-0236, and CVE-2017-0238." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-05-23T18:09Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0230", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98222", "name" : "98222", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0230", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0230", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in Microsoft Edge in the way JavaScript engines render when handling objects in memory, aka \"Scripting Engine Memory Corruption Vulnerability.\" This CVE ID is unique from CVE-2017-0224, CVE-2017-0228, CVE-2017-0229, CVE-2017-0234, CVE-2017-0235, CVE-2017-0236, and CVE-2017-0238." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-05-23T18:09Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0231", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "internet_explorer", "version" : { "version_data" : [ { "version_value" : "11", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98173", "name" : "98173", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038455", "name" : "1038455", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038456", "name" : "1038456", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0231", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0231", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A spoofing vulnerability exists when Microsoft browsers render SmartScreen Filter, aka \"Microsoft Browser Spoofing Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-07-08T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0233", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98179", "name" : "98179", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0233", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0233", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability exists in Microsoft Edge that could allow an attacker to escape from the AppContainer sandbox in the browser, aka \"Microsoft Edge Elevation of Privilege Vulnerability.\" This CVE ID is unique from CVE-2017-0241." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "CHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.3, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 6.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 5.1 }, "severity" : "MEDIUM", "exploitabilityScore" : 4.9, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0234", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98229", "name" : "98229", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038431", "name" : "1038431", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0234", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0234", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects in memory, aka \"Scripting Engine Memory Corruption Vulnerability.\" This CVE ID is unique from CVE-2017-0224, CVE-2017-0228, CVE-2017-0229, CVE-2017-0230, CVE-2017-0235, CVE-2017-0236, and CVE-2017-0238." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-07-08T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0235", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98230", "name" : "98230", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0235", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0235", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects in memory, aka \"Scripting Engine Memory Corruption Vulnerability.\" This CVE ID is unique from CVE-2017-0224, CVE-2017-0228, CVE-2017-0229, CVE-2017-0230, CVE-2017-0234, CVE-2017-0236, and CVE-2017-0238." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-05-23T18:10Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0236", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98234", "name" : "98234", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038431", "name" : "1038431", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0236", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0236", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects in memory, aka \"Scripting Engine Memory Corruption Vulnerability.\" This CVE ID is unique from CVE-2017-0224, CVE-2017-0228, CVE-2017-0229, CVE-2017-0230, CVE-2017-0234, CVE-2017-0235, and CVE-2017-0238." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-07-08T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0238", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "internet_explorer", "version" : { "version_data" : [ { "version_value" : "9", "version_affected" : "=" }, { "version_value" : "10", "version_affected" : "=" }, { "version_value" : "11", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98237", "name" : "98237", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0238", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0238", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in Microsoft browsers in the way JavaScript scripting engines handle objects in memory, aka \"Scripting Engine Memory Corruption Vulnerability.\" This CVE ID is unique from CVE-2017-0224, CVE-2017-0228, CVE-2017-0229, CVE-2017-0230, CVE-2017-0234, CVE-2017-0235, and CVE-2017-0236." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-05-23T18:39Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0240", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98203", "name" : "98203", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038424", "name" : "1038424", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0240", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0240", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in Microsoft Edge in the way affected Microsoft scripting engines render when handling objects in memory, aka \"Microsoft Edge Memory Corruption Vulnerability.\" This CVE ID is unique from CVE-2017-0221 and CVE-2017-0227." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-07-08T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0241", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98208", "name" : "98208", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0241", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0241", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability exists when Microsoft Edge renders a domain-less page in the URL, which could allow Microsoft Edge to perform actions in the context of the Intranet Zone and access functionality that is not typically available to the browser when browsing in the context of the Internet Zone, aka \"Microsoft Edge Elevation of Privilege Vulnerability.\" This CVE ID is unique from CVE-2017-0233." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "availabilityImpact" : "NONE", "baseScore" : 5.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.6, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:N/I:C/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "NONE", "baseScore" : 5.4 }, "severity" : "MEDIUM", "exploitabilityScore" : 4.9, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0242", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98275", "name" : "98275", "refsource" : "BID", "tags" : [ "Third Party Advisory", "US Government Resource" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0242", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0242", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability exists in the way some ActiveX objects are instantiated, aka \"Microsoft ActiveX Information Disclosure Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:itanium:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-05-23T19:43Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0243", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "business_productivity_servers", "version" : { "version_data" : [ { "version_value" : "2010", "version_affected" : "=" } ] } }, { "product_name" : "office", "version" : { "version_data" : [ { "version_value" : "2007", "version_affected" : "=" }, { "version_value" : "2010", "version_affected" : "=" } ] } }, { "product_name" : "web_applications", "version" : { "version_data" : [ { "version_value" : "2010", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99446", "name" : "99446", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038851", "name" : "1038851", "refsource" : "SECTRACK", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-0243", "name" : "https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-0243", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka \"Microsoft Office Remote Code Execution Vulnerability\". This CVE ID is unique from CVE-2017-8570." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:business_productivity_servers:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:web_applications:2010:sp2:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-07-11T21:29Z", "lastModifiedDate" : "2017-07-20T13:27Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0244", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98109", "name" : "98109", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038453", "name" : "1038453", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0244", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0244", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The kernel in Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows locally authenticated attackers to gain privileges via a crafted application, or in Windows 7 for x64-based systems, cause denial of service, aka \"Windows Kernel Elevation of Privilege Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:itanium:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "LOW", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 6.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 0.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 6.9 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.4, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0245", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98115", "name" : "98115", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0245", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0245", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/42008/", "name" : "42008", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The kernel-mode drivers in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1 and Windows Server 2012 Gold allow a local authenticated attacker to execute a specially crafted application to obtain kernel information, aka \"Win32k Information Disclosure Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 1.9 }, "severity" : "LOW", "exploitabilityScore" : 3.4, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-08-13T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0246", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98108", "name" : "98108", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038449", "name" : "1038449", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0246", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0246", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Graphics Component in the kernel-mode drivers in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows local users to gain privileges via a crafted application or in Windows 7 for x64-based Systems and later, cause denial of service, aka \"Win32k Elevation of Privilege Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 6.9 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.4, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0247", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "microsoft.aspnetcore.mvc", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.abstractions", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.apiexplorer", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.core", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.cors", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.dataannotations", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.formatters.json", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.formatters.xml", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.localization", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.razor", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.razor.host", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.taghelpers", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.viewfeatures", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.webapicompatshim", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "system.net.http", "version" : { "version_data" : [ { "version_value" : "4.1.1", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" } ] } }, { "product_name" : "system.net.http.winhttphandler", "version" : { "version_data" : [ { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.3.0", "version_affected" : "=" } ] } }, { "product_name" : "system.net.security", "version" : { "version_data" : [ { "version_value" : "4.0.0", "version_affected" : "=" }, { "version_value" : "4.3.0", "version_affected" : "=" } ] } }, { "product_name" : "system.net.websockets.client", "version" : { "version_data" : [ { "version_value" : "4.0.0", "version_affected" : "=" }, { "version_value" : "4.3.0", "version_affected" : "=" } ] } }, { "product_name" : "system.text.encodings.web", "version" : { "version_data" : [ { "version_value" : "4.0.0", "version_affected" : "=" }, { "version_value" : "4.3.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://github.com/aspnet/Announcements/issues/239", "name" : "https://github.com/aspnet/Announcements/issues/239", "refsource" : "MISC", "tags" : [ "Technical Description", "Third Party Advisory" ] }, { "url" : "https://technet.microsoft.com/en-us/library/security/4021279.aspx", "name" : "https://technet.microsoft.com/en-us/library/security/4021279.aspx", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.sidertia.com/Home/Community/Blog/2017/05/18/ASPNET-Core-Unicode-Non-Char-Encoding-DoS", "name" : "https://www.sidertia.com/Home/Community/Blog/2017/05/18/ASPNET-Core-Unicode-Non-Char-Encoding-DoS", "refsource" : "MISC", "tags" : [ "Exploit", "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability exists when the ASP.NET Core fails to properly validate web requests. NOTE: Microsoft has not commented on third-party claims that the issue is that the TextEncoder.EncodeCore function in the System.Text.Encodings.Web package in ASP.NET Core Mvc before 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to cause a denial of service by leveraging failure to properly calculate the length of 4-byte characters in the Unicode Non-Character range." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.abstractions:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.abstractions:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.abstractions:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.abstractions:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.abstractions:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.abstractions:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.abstractions:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.apiexplorer:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.apiexplorer:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.apiexplorer:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.apiexplorer:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.apiexplorer:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.apiexplorer:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.apiexplorer:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.core:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.core:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.core:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.core:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.core:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.core:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.core:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.cors:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.cors:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.cors:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.cors:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.cors:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.cors:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.cors:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.dataannotations:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.dataannotations:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.dataannotations:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.dataannotations:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.dataannotations:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.dataannotations:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.dataannotations:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.json:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.json:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.json:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.json:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.json:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.json:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.json:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.xml:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.xml:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.xml:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.xml:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.xml:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.xml:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.xml:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.localization:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.localization:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.localization:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.localization:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.localization:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.localization:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.localization:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor.host:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor.host:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor.host:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor.host:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor.host:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor.host:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor.host:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.taghelpers:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.taghelpers:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.taghelpers:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.taghelpers:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.taghelpers:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.taghelpers:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.taghelpers:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.viewfeatures:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.viewfeatures:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.viewfeatures:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.viewfeatures:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.viewfeatures:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.viewfeatures:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.viewfeatures:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.webapicompatshim:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.webapicompatshim:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.webapicompatshim:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.webapicompatshim:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.webapicompatshim:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.webapicompatshim:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.webapicompatshim:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.net.http:4.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.net.http:4.3.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.net.http.winhttphandler:4.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.net.http.winhttphandler:4.3.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.net.security:4.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.net.security:4.3.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.net.websockets.client:4.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.net.websockets.client:4.3.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.text.encodings.web:4.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.text.encodings.web:4.3.0:*:*:*:*:asp.net:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "availabilityImpact" : "NONE", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-08-10T17:59Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0248", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : ".net_framework", "version" : { "version_data" : [ { "version_value" : "2.0", "version_affected" : "=" }, { "version_value" : "3.5", "version_affected" : "=" }, { "version_value" : "3.5.1", "version_affected" : "=" }, { "version_value" : "4.5.2", "version_affected" : "=" }, { "version_value" : "4.6", "version_affected" : "=" }, { "version_value" : "4.6.1", "version_affected" : "=" }, { "version_value" : "4.6.2", "version_affected" : "=" }, { "version_value" : "4.7", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-295" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98117", "name" : "98117", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038458", "name" : "1038458", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0248", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0248", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to bypass Enhanced Security Usage taggings when they present a certificate that is invalid for a specific use, aka \".NET Security Feature Bypass Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:.net_framework:3.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:.net_framework:4.5.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:.net_framework:4.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:.net_framework:4.6.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:.net_framework:4.7:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "availabilityImpact" : "NONE", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0249", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "microsoft.aspnetcore.mvc", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.abstractions", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.apiexplorer", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.core", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.cors", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.dataannotations", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.formatters.json", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.formatters.xml", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.localization", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.razor", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.razor.host", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.taghelpers", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.viewfeatures", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.webapicompatshim", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "system.net.http", "version" : { "version_data" : [ { "version_value" : "4.1.1", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" } ] } }, { "product_name" : "system.net.http.winhttphandler", "version" : { "version_data" : [ { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.3.0", "version_affected" : "=" } ] } }, { "product_name" : "system.net.security", "version" : { "version_data" : [ { "version_value" : "4.0.0", "version_affected" : "=" }, { "version_value" : "4.3.0", "version_affected" : "=" } ] } }, { "product_name" : "system.net.websockets.client", "version" : { "version_data" : [ { "version_value" : "4.0.0", "version_affected" : "=" }, { "version_value" : "4.3.0", "version_affected" : "=" } ] } }, { "product_name" : "system.text.encodings.web", "version" : { "version_data" : [ { "version_value" : "4.0.0", "version_affected" : "=" }, { "version_value" : "4.3.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://github.com/aspnet/Announcements/issues/239", "name" : "https://github.com/aspnet/Announcements/issues/239", "refsource" : "MISC", "tags" : [ "Technical Description", "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability exists when the ASP.NET Core fails to properly sanitize web requests." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.abstractions:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.abstractions:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.abstractions:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.abstractions:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.abstractions:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.abstractions:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.abstractions:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.apiexplorer:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.apiexplorer:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.apiexplorer:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.apiexplorer:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.apiexplorer:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.apiexplorer:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.apiexplorer:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.core:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.core:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.core:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.core:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.core:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.core:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.core:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.cors:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.cors:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.cors:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.cors:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.cors:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.cors:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.cors:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.dataannotations:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.dataannotations:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.dataannotations:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.dataannotations:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.dataannotations:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.dataannotations:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.dataannotations:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.json:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.json:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.json:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.json:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.json:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.json:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.json:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.xml:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.xml:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.xml:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.xml:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.xml:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.xml:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.xml:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.localization:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.localization:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.localization:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.localization:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.localization:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.localization:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.localization:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor.host:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor.host:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor.host:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor.host:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor.host:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor.host:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor.host:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.taghelpers:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.taghelpers:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.taghelpers:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.taghelpers:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.taghelpers:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.taghelpers:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.taghelpers:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.viewfeatures:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.viewfeatures:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.viewfeatures:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.viewfeatures:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.viewfeatures:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.viewfeatures:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.viewfeatures:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.webapicompatshim:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.webapicompatshim:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.webapicompatshim:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.webapicompatshim:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.webapicompatshim:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.webapicompatshim:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.webapicompatshim:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.net.http:4.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.net.http:4.3.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.net.http.winhttphandler:4.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.net.http.winhttphandler:4.3.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.net.security:4.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.net.security:4.3.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.net.websockets.client:4.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.net.websockets.client:4.3.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.text.encodings.web:4.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.text.encodings.web:4.3.0:*:*:*:*:asp.net:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "LOW", "baseScore" : 7.3, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 7.5 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-08-10T18:00Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0250", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98100", "name" : "98100", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1039090", "name" : "1039090", "refsource" : "SECTRACK", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0250", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0250", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft JET Database Engine in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows a remote code execution vulnerability due to buffer overflow, aka \"Microsoft JET Database Engine Remote Code Execution Vulnerability\"." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-08T21:29Z", "lastModifiedDate" : "2017-08-15T17:24Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0252", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://github.com/Microsoft/ChakraCore/pull/2959", "name" : "https://github.com/Microsoft/ChakraCore/pull/2959", "refsource" : "CONFIRM", "tags" : [ "Patch", "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in Microsoft Chakra Core in the way JavaScript engines render when handling objects in memory. aka \"Scripting Engine Memory Corruption Vulnerability\". This vulnerability is unique from CVE-2017-0223." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 9.8, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 3.9, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 7.5 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.4, "acInsufInfo" : true, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-15T17:29Z", "lastModifiedDate" : "2017-05-24T14:30Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0254", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "office", "version" : { "version_data" : [ { "version_value" : "2010", "version_affected" : "=" }, { "version_value" : "2011", "version_affected" : "=" }, { "version_value" : "2016", "version_affected" : "=" } ] } }, { "product_name" : "office_compatibility_pack", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "office_web_apps", "version" : { "version_data" : [ { "version_value" : "2010", "version_affected" : "=" }, { "version_value" : "2013", "version_affected" : "=" } ] } }, { "product_name" : "sharepoint_server", "version" : { "version_data" : [ { "version_value" : "2013", "version_affected" : "=" }, { "version_value" : "2016", "version_affected" : "=" } ] } }, { "product_name" : "word", "version" : { "version_data" : [ { "version_value" : "2007", "version_affected" : "=" }, { "version_value" : "2010", "version_affected" : "=" }, { "version_value" : "2013", "version_affected" : "=" }, { "version_value" : "2016", "version_affected" : "=" } ] } }, { "product_name" : "word_rt", "version" : { "version_data" : [ { "version_value" : "2013", "version_affected" : "=" } ] } }, { "product_name" : "word_viewer", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98101", "name" : "98101", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038443", "name" : "1038443", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0254", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0254", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Word 2007, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Office for Mac 2011, Office for Mac 2016, Microsoft Office Web Apps 2010 SP2, Office Web Apps Server 2013 SP1, Word 2013 RT SP1, Word 2013 SP1, Word Automation Services on Microsoft SharePoint Server 2013 SP1, Office Word Viewer, SharePoint Enterprise Server 2016, and Word 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka \"Microsoft Office Memory Corruption Vulnerability\". This CVE ID is unique from CVE-2017-0264 and CVE-2017-0265." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2011:*:mac:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2016:*:mac:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office_compatibility_pack:*:sp3:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office_web_apps:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office_web_apps:2013:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:sharepoint_server:2013:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word:2007:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word:2013:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word_rt:2013:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word_viewer:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-07-08T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0255", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "sharepoint_foundation", "version" : { "version_data" : [ { "version_value" : "2013", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-79" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98107", "name" : "98107", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0255", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0255", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft SharePoint Foundation 2013 SP1 allows an elevation of privilege vulnerability when it does not properly sanitize a specially crafted web request, aka \"Microsoft SharePoint XSS Vulnerability\"." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "REQUIRED", "scope" : "CHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 5.4, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.3, "impactScore" : 2.7 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:S/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 3.5 }, "severity" : "LOW", "exploitabilityScore" : 6.8, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-05-23T19:51Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0256", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "microsoft.aspnetcore.mvc", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.abstractions", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.apiexplorer", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.core", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.cors", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.dataannotations", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.formatters.json", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.formatters.xml", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.localization", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.razor", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.razor.host", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.taghelpers", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.viewfeatures", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "microsoft.aspnetcore.mvc.webapicompatshim", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.0.3", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.2", "version_affected" : "=" } ] } }, { "product_name" : "system.net.http", "version" : { "version_data" : [ { "version_value" : "4.1.1", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" } ] } }, { "product_name" : "system.net.http.winhttphandler", "version" : { "version_data" : [ { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.3.0", "version_affected" : "=" } ] } }, { "product_name" : "system.net.security", "version" : { "version_data" : [ { "version_value" : "4.0.0", "version_affected" : "=" }, { "version_value" : "4.3.0", "version_affected" : "=" } ] } }, { "product_name" : "system.net.websockets.client", "version" : { "version_data" : [ { "version_value" : "4.0.0", "version_affected" : "=" }, { "version_value" : "4.3.0", "version_affected" : "=" } ] } }, { "product_name" : "system.text.encodings.web", "version" : { "version_data" : [ { "version_value" : "4.0.0", "version_affected" : "=" }, { "version_value" : "4.3.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://github.com/aspnet/Announcements/issues/239", "name" : "https://github.com/aspnet/Announcements/issues/239", "refsource" : "MISC", "tags" : [ "Technical Description", "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.abstractions:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.abstractions:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.abstractions:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.abstractions:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.abstractions:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.abstractions:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.abstractions:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.apiexplorer:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.apiexplorer:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.apiexplorer:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.apiexplorer:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.apiexplorer:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.apiexplorer:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.apiexplorer:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.core:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.core:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.core:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.core:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.core:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.core:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.core:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.cors:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.cors:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.cors:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.cors:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.cors:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.cors:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.cors:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.dataannotations:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.dataannotations:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.dataannotations:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.dataannotations:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.dataannotations:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.dataannotations:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.dataannotations:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.json:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.json:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.json:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.json:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.json:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.json:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.json:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.xml:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.xml:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.xml:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.xml:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.xml:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.xml:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.formatters.xml:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.localization:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.localization:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.localization:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.localization:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.localization:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.localization:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.localization:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor.host:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor.host:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor.host:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor.host:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor.host:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor.host:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.razor.host:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.taghelpers:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.taghelpers:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.taghelpers:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.taghelpers:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.taghelpers:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.taghelpers:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.taghelpers:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.viewfeatures:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.viewfeatures:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.viewfeatures:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.viewfeatures:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.viewfeatures:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.viewfeatures:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.viewfeatures:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.webapicompatshim:1.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.webapicompatshim:1.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.webapicompatshim:1.0.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.webapicompatshim:1.0.3:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.webapicompatshim:1.1.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.webapicompatshim:1.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:microsoft.aspnetcore.mvc.webapicompatshim:1.1.2:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.net.http:4.1.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.net.http:4.3.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.net.http.winhttphandler:4.0.1:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.net.http.winhttphandler:4.3.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.net.security:4.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.net.security:4.3.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.net.websockets.client:4.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.net.websockets.client:4.3.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.text.encodings.web:4.0.0:*:*:*:*:asp.net:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:system.text.encodings.web:4.3.0:*:*:*:*:asp.net:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 5.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 3.9, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-08-10T19:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0258", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98112", "name" : "98112", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038446", "name" : "1038446", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0258", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0258", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/42006/", "name" : "42006", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows authenticated attackers to obtain sensitive information via a specially crafted document, aka \"Windows Kernel Information Disclosure Vulnerability,\" a different vulnerability than CVE-2017-0175, CVE-2017-0220, and CVE-2017-0259." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:itanium:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 1.9 }, "severity" : "LOW", "exploitabilityScore" : 3.4, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-08-13T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0259", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98113", "name" : "98113", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0259", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0259", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/42007/", "name" : "42007", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Windows kernel in Microsoft Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows authenticated attackers to obtain sensitive information via a specially crafted document, aka \"Windows Kernel Information Disclosure Vulnerability,\" a different vulnerability than CVE-2017-0175, CVE-2017-0220, and CVE-2017-0258." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 1.9 }, "severity" : "LOW", "exploitabilityScore" : 3.4, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-08-13T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0260", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "office", "version" : { "version_data" : [ { "version_value" : "2013", "version_affected" : "=" }, { "version_value" : "2016", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98810", "name" : "98810", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038668", "name" : "1038668", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0260", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0260", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka \"Office Remote Code Execution Vulnerability\". This CVE ID is unique from CVE-2017-8509, CVE-2017-8510, CVE-2017-8511, CVE-2017-8512, and CVE-2017-8506." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-15T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0261", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "office", "version" : { "version_data" : [ { "version_value" : "2010", "version_affected" : "=" }, { "version_value" : "2013", "version_affected" : "=" }, { "version_value" : "2016", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-416" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98104", "name" : "98104", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038444", "name" : "1038444", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0261", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0261", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka \"Office Remote Code Execution Vulnerability\". This CVE ID is unique from CVE-2017-0262 and CVE-2017-0281." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0262", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "office", "version" : { "version_data" : [ { "version_value" : "2010", "version_affected" : "=" }, { "version_value" : "2013", "version_affected" : "=" }, { "version_value" : "2016", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98279", "name" : "98279", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0262", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0262", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka \"Office Remote Code Execution Vulnerability\". This CVE ID is unique from CVE-2017-0261 and CVE-2017-0281." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0263", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-416" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98258", "name" : "98258", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038449", "name" : "1038449", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0263", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0263", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/44478/", "name" : "44478", "refsource" : "EXPLOIT-DB", "tags" : [ ] }, { "url" : "https://xiaodaozhi.com/exploit/117.html", "name" : "https://xiaodaozhi.com/exploit/117.html", "refsource" : "MISC", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The kernel-mode drivers in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow local users to gain privileges via a crafted application, aka \"Win32k Elevation of Privilege Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0264", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "powerpoint_for_mac", "version" : { "version_data" : [ { "version_value" : "2011", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98282", "name" : "98282", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0264", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0264", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft PowerPoint for Mac 2011 allows a remote code execution vulnerability when the software fails to properly handle objects in memory, aka \"Microsoft Office Memory Corruption Vulnerability\". This CVE ID is unique from CVE-2017-0254 and CVE-2017-0265." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:powerpoint_for_mac:2011:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-05-23T19:49Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0265", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "powerpoint_for_mac", "version" : { "version_data" : [ { "version_value" : "2011", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98285", "name" : "98285", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038448", "name" : "1038448", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0265", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0265", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft PowerPoint for Mac 2011 allows a remote code execution vulnerability when the software fails to properly handle objects in memory, aka \"Microsoft Office Memory Corruption Vulnerability\". This CVE ID is unique from CVE-2017-0254 and CVE-2017-0264." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:powerpoint_for_mac:2011:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-07-08T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0266", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "edge", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98276", "name" : "98276", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0266", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0266", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability exists in Microsoft Edge in the way affected Microsoft scripting engines render when handling objects in memory, aka \"Microsoft Edge Remote Code Execution Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2017-05-23T19:08Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0267", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98259", "name" : "98259", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038432", "name" : "1038432", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "name" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0267", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0267", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 handles certain requests, aka \"Windows SMB Information Disclosure Vulnerability\". This CVE ID is unique from CVE-2017-0268, CVE-2017-0270, CVE-2017-0271, CVE-2017-0274, CVE-2017-0275, and CVE-2017-0276." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.9, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.2, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2018-03-28T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0268", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98261", "name" : "98261", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "name" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0268", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0268", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 handles certain requests, aka \"Windows SMB Information Disclosure Vulnerability\". This CVE ID is unique from CVE-2017-0267, CVE-2017-0270, CVE-2017-0271, CVE-2017-0274, CVE-2017-0275, and CVE-2017-0276." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.9, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.2, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2018-03-28T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0269", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98263", "name" : "98263", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038433", "name" : "1038433", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "name" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0269", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0269", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Microsoft Server Message Block 1.0 (SMBv1) allows denial of service when an attacker sends specially crafted requests to the server, aka \"Windows SMB Denial of Service Vulnerability\". This CVE ID is unique from CVE-2017-0273 and CVE-2017-0280." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.9, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.2, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2018-03-28T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0270", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98264", "name" : "98264", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "name" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0270", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0270", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 handles certain requests, aka \"Windows SMB Information Disclosure Vulnerability\". This CVE ID is unique from CVE-2017-0267, CVE-2017-0268, CVE-2017-0271, CVE-2017-0274, CVE-2017-0275, and CVE-2017-0276." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.9, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.2, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2018-03-28T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0271", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98265", "name" : "98265", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038432", "name" : "1038432", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "name" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0271", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0271", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 handles certain requests, aka \"Windows SMB Information Disclosure Vulnerability\". This CVE ID is unique from CVE-2017-0267, CVE-2017-0268, CVE-2017-0270, CVE-2017-0274, CVE-2017-0275, and CVE-2017-0276." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.9, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.2, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2018-03-28T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0272", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98260", "name" : "98260", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "name" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0272", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0272", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Microsoft Server Message Block 1.0 (SMBv1) server on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to execute remote code by the way it handles certain requests, aka \"Windows SMB Remote Code Execution Vulnerability\". This CVE ID is unique from CVE-2017-0277, CVE-2017-0278, and CVE-2017-0279." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.1, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.2, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0273", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98274", "name" : "98274", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038433", "name" : "1038433", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "name" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0273", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0273", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Microsoft Server Message Block 1.0 (SMBv1) allows denial of service when an attacker sends specially crafted requests to the server, aka \"Windows SMB Denial of Service Vulnerability\". This CVE ID is unique from CVE-2017-0269 and CVE-2017-0280." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.9, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.2, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2018-03-28T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0274", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98266", "name" : "98266", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "name" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0274", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0274", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 handles certain requests, aka \"Windows SMB Information Disclosure Vulnerability\". This CVE ID is unique from CVE-2017-0267, CVE-2017-0268, CVE-2017-0270, CVE-2017-0271, CVE-2017-0275, and CVE-2017-0276." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.9, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.2, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2018-03-28T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0275", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98267", "name" : "98267", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038432", "name" : "1038432", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "name" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0275", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0275", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 handles certain requests, aka \"Windows SMB Information Disclosure Vulnerability\". This CVE ID is unique from CVE-2017-0267, CVE-2017-0268, CVE-2017-0270, CVE-2017-0271, CVE-2017-0274, and CVE-2017-0276." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.9, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.2, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2018-03-28T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0276", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98268", "name" : "98268", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "name" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0276", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0276", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Server Message Block 1.0 (SMBv1) allows an information disclosure vulnerability in the way that Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 handles certain requests, aka \"Windows SMB Information Disclosure Vulnerability\". This CVE ID is unique from CVE-2017-0267, CVE-2017-0268, CVE-2017-0270, CVE-2017-0271, CVE-2017-0274, and CVE-2017-0275." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.9, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.2, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2018-03-28T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0277", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98270", "name" : "98270", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038430", "name" : "1038430", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "name" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0277", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0277", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Microsoft Server Message Block 1.0 (SMBv1) server on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to execute remote code by the way it handles certain requests, aka \"Windows SMB Remote Code Execution Vulnerability\". This CVE ID is unique from CVE-2017-0272, CVE-2017-0278, and CVE-2017-0279." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "LOW", "availabilityImpact" : "LOW", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.2, "impactScore" : 4.7 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0278", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98271", "name" : "98271", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038430", "name" : "1038430", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "name" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0278", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0278", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Microsoft Server Message Block 1.0 (SMBv1) server on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to execute remote code by the way it handles certain requests, aka \"Windows SMB Remote Code Execution Vulnerability\". This CVE ID is unique from CVE-2017-0272, CVE-2017-0277, and CVE-2017-0279." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "LOW", "availabilityImpact" : "LOW", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.2, "impactScore" : 4.7 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0279", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98272", "name" : "98272", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038430", "name" : "1038430", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "name" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0279", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0279", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Microsoft Server Message Block 1.0 (SMBv1) server on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to execute remote code by the way it handles certain requests, aka \"Windows SMB Remote Code Execution Vulnerability\". This CVE ID is unique from CVE-2017-0272, CVE-2017-0277, and CVE-2017-0278." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "LOW", "availabilityImpact" : "LOW", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.2, "impactScore" : 4.7 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0280", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98273", "name" : "98273", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "name" : "https://ics-cert.us-cert.gov/advisories/ICSMA-18-058-02", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0280", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0280", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Microsoft Server Message Block 1.0 (SMBv1) allows denial of service when an attacker sends specially crafted requests to the server, aka \"Windows SMB Denial of Service Vulnerability\". This CVE ID is unique from CVE-2017-0269 and CVE-2017-0273." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.9, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.2, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2018-03-28T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0281", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "office", "version" : { "version_data" : [ { "version_value" : "2007", "version_affected" : "=" }, { "version_value" : "2010", "version_affected" : "=" }, { "version_value" : "2013", "version_affected" : "=" }, { "version_value" : "2016", "version_affected" : "=" } ] } }, { "product_name" : "office_online_server", "version" : { "version_data" : [ { "version_value" : "2016", "version_affected" : "=" } ] } }, { "product_name" : "office_web_apps", "version" : { "version_data" : [ { "version_value" : "2010", "version_affected" : "=" }, { "version_value" : "2013", "version_affected" : "=" } ] } }, { "product_name" : "project_server", "version" : { "version_data" : [ { "version_value" : "2013", "version_affected" : "=" } ] } }, { "product_name" : "sharepoint_foundation", "version" : { "version_data" : [ { "version_value" : "2013", "version_affected" : "=" } ] } }, { "product_name" : "sharepoint_server", "version" : { "version_data" : [ { "version_value" : "2010", "version_affected" : "=" }, { "version_value" : "2013", "version_affected" : "=" }, { "version_value" : "2016", "version_affected" : "=" } ] } }, { "product_name" : "skype_for_business", "version" : { "version_data" : [ { "version_value" : "2016", "version_affected" : "=" } ] } }, { "product_name" : "word", "version" : { "version_data" : [ { "version_value" : "2016", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98297", "name" : "98297", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0281", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0281", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online Server 2016, Office Web Apps 2010 SP2,Office Web Apps 2013 SP1, Project Server 2013 SP1, SharePoint Enterprise Server 2013 SP1, SharePoint Enterprise Server 2016, SharePoint Foundation 2013 SP1, Sharepoint Server 2010 SP2, Word 2016, and Skype for Business 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka \"Office Remote Code Execution Vulnerability\". This CVE ID is unique from CVE-2017-0261 and CVE-2017-0262." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office_online_server:2016:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office_web_apps:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office_web_apps:2013:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:project_server:2013:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:sharepoint_server:2013:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:sharepoint_server:2016:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:skype_for_business:2016:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T14:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0282", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "rt", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98885", "name" : "98885", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0282", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0282", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/42237/", "name" : "42237", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, Windows Server 2016, Microsoft Office 2007 SP3, and Microsoft Office 2010 SP2 allows improper disclosure of memory contents, aka \"Windows Uniscribe Information Disclosure Vulnerability\". This CVE ID is unique from CVE-2017-0284, CVE-2017-0285, and CVE-2017-8534." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:rt:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.0, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.3, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 1.9 }, "severity" : "LOW", "exploitabilityScore" : 3.4, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-15T01:29Z", "lastModifiedDate" : "2017-08-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0283", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "lync", "version" : { "version_data" : [ { "version_value" : "2013", "version_affected" : "=" } ] } }, { "product_name" : "office", "version" : { "version_data" : [ { "version_value" : "2007", "version_affected" : "=" }, { "version_value" : "2010", "version_affected" : "=" } ] } }, { "product_name" : "office_word_viewer", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "silverlight", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" } ] } }, { "product_name" : "skype_for_business", "version" : { "version_data" : [ { "version_value" : "2016", "version_affected" : "=" } ] } }, { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "rt", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98920", "name" : "98920", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038675", "name" : "1038675", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://0patch.blogspot.com/2017/07/0patching-quick-brown-fox-of-cve-2017.html", "name" : "https://0patch.blogspot.com/2017/07/0patching-quick-brown-fox-of-cve-2017.html", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://bugs.chromium.org/p/project-zero/issues/detail?id=1198", "name" : "https://bugs.chromium.org/p/project-zero/issues/detail?id=1198", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0283", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0283", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/42234/", "name" : "42234", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, Windows Server 2016, Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office Word Viewer, Microsoft Lync 2013 SP1, Skype for Business 2016, Microsoft Silverlight 5 Developer Runtime when installed on Microsoft Windows, and Microsoft Silverlight 5 when installed on Microsoft Windows allows a remote code execution vulnerability due to the way it handles objects in memory, aka \"Windows Uniscribe Remote Code Execution Vulnerability\". This CVE ID is unique from CVE-2017-8528." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:lync:2013:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:office_word_viewer:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:silverlight:5.0:*:*:*:*:windows:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:skype_for_business:2016:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:rt:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-15T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0284", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "rt", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98918", "name" : "98918", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0284", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0284", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/42235/", "name" : "42235", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, Windows Server 2016, Microsoft Office 2007 SP3, and Microsoft Office 2010 SP2 allows improper disclosure of memory contents, aka \"Windows Uniscribe Information Disclosure Vulnerability\". This CVE ID is unique from CVE-2017-0282, CVE-2017-0285, and CVE-2017-8534." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:rt:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.0, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.3, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 1.9 }, "severity" : "LOW", "exploitabilityScore" : 3.4, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-15T01:29Z", "lastModifiedDate" : "2017-08-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0285", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "rt", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98914", "name" : "98914", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0285", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0285", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/42236/", "name" : "42236", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, Windows Server 2016, Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, and Microsoft Office Word Viewer allows improper disclosure of memory contents, aka \"Windows Uniscribe Information Disclosure Vulnerability\". This CVE ID is unique from CVE-2017-0282, CVE-2017-0284, and CVE-2017-8534." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:rt:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.0, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.3, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 1.9 }, "severity" : "LOW", "exploitabilityScore" : 3.4, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-15T01:29Z", "lastModifiedDate" : "2017-08-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0286", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "rt", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98891", "name" : "98891", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0286", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0286", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/42238/", "name" : "42238", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows improper disclosure of memory contents, aka \"Windows Graphics Information Disclosure Vulnerability\". This CVE ID is unique from CVE-2017-0287, CVE-2017-0288, CVE-2017-0289, CVE-2017-8531, CVE-2017-8532, and CVE-2017-8533." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:rt:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.0, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.3, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 1.9 }, "severity" : "LOW", "exploitabilityScore" : 3.4, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-15T01:29Z", "lastModifiedDate" : "2017-08-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0287", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "rt", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98922", "name" : "98922", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038662", "name" : "1038662", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0287", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0287", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/42239/", "name" : "42239", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows improper disclosure of memory contents, aka \"Graphics Uniscribe Information Disclosure Vulnerability\". This CVE ID is unique from CVE-2017-0286, CVE-2017-0288, CVE-2017-0289, CVE-2017-8531, CVE-2017-8532, and CVE-2017-8533." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:rt:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.0, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.3, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 1.9 }, "severity" : "LOW", "exploitabilityScore" : 3.4, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-15T01:29Z", "lastModifiedDate" : "2017-08-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0288", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "rt", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98923", "name" : "98923", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0288", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0288", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/42241/", "name" : "42241", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows improper disclosure of memory contents, aka \"Windows Graphics Information Disclosure Vulnerability\". This CVE ID is unique from CVE-2017-0286, CVE-2017-0287, CVE-2017-0289, CVE-2017-8531, CVE-2017-8532, and CVE-2017-8533." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:rt:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.0, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.3, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 1.9 }, "severity" : "LOW", "exploitabilityScore" : 3.4, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-15T01:29Z", "lastModifiedDate" : "2017-08-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0289", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "rt", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98929", "name" : "98929", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038662", "name" : "1038662", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0289", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0289", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/42240/", "name" : "42240", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows improper disclosure of memory contents, aka \"Windows Graphics Information Disclosure Vulnerability\". This CVE ID is unique from CVE-2017-0286, CVE-2017-0287, CVE-2017-0288, CVE-2017-8531, CVE-2017-8532, and CVE-2017-8533." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:rt:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.0, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.3, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 1.9 }, "severity" : "LOW", "exploitabilityScore" : 3.4, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-15T01:29Z", "lastModifiedDate" : "2017-08-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0290", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "forefront_security", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "malware_protection_engine", "version" : { "version_data" : [ { "version_value" : "1.1.13701.0", "version_affected" : "<=" } ] } }, { "product_name" : "windows_defender", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98330", "name" : "98330", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038419", "name" : "1038419", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038420", "name" : "1038420", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://0patch.blogspot.si/2017/05/0patching-worst-windows-remote-code.html", "name" : "https://0patch.blogspot.si/2017/05/0patching-worst-windows-remote-code.html", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://arstechnica.com/information-technology/2017/05/windows-defender-nscript-remote-vulnerability/", "name" : "https://arstechnica.com/information-technology/2017/05/windows-defender-nscript-remote-vulnerability/", "refsource" : "MISC", "tags" : [ "Press/Media Coverage", "Third Party Advisory" ] }, { "url" : "https://bugs.chromium.org/p/project-zero/issues/detail?id=1252", "name" : "https://bugs.chromium.org/p/project-zero/issues/detail?id=1252", "refsource" : "MISC", "tags" : [ "Exploit", "Third Party Advisory" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0290", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0290", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://technet.microsoft.com/library/security/4022344", "name" : "https://technet.microsoft.com/library/security/4022344", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://twitter.com/natashenka/status/861748397409058816", "name" : "https://twitter.com/natashenka/status/861748397409058816", "refsource" : "MISC", "tags" : [ "Exploit", "Third Party Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41975/", "name" : "41975", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 does not properly scan a specially crafted file leading to memory corruption, aka \"Microsoft Malware Protection Engine Remote Code Execution Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:forefront_security:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:malware_protection_engine:*:*:*:*:*:*:*:*", "versionEndIncluding" : "1.1.13701.0" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:windows_defender:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:gold:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-09T06:29Z", "lastModifiedDate" : "2019-05-08T22:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0291", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98835", "name" : "98835", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0291", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0291", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Windows PDF in Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows remote code execution if a user opens a specially crafted PDF file, aka \"Windows PDF Remote Code Execution Vulnerability\". This CVE ID is unique from CVE-2017-0292." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-15T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0292", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "word", "version" : { "version_data" : [ { "version_value" : "2013", "version_affected" : "=" }, { "version_value" : "2016", "version_affected" : "=" } ] } }, { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98836", "name" : "98836", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038678", "name" : "1038678", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0292", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0292", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Windows PDF in Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows remote code execution if a user opens a specially crafted PDF file, aka \"Windows PDF Remote Code Execution Vulnerability\". This CVE ID is unique from CVE-2017-0291." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word:2013:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word:2013:sp1:*:*:rt:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-15T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0293", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100039", "name" : "100039", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1039092", "name" : "1039092", "refsource" : "SECTRACK", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0293", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0293", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Windows PDF Library in Windows Server 2008 R2 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows a remote code execution vulnerability when it improperly handles objects in memory, aka \"Windows PDF Remote Code Execution Vulnerability\"." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.6, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-08T21:29Z", "lastModifiedDate" : "2017-08-15T17:54Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0294", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_rt_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98837", "name" : "98837", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0294", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0294", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute remote code when Windows fails to properly handle cabinet files, aka \"Windows Remote Code Execution Vulnerability\"." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-15T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0295", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98904", "name" : "98904", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038674", "name" : "1038674", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0295", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0295", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Windows 10 1607 and 1703, and Windows Server 2016 allow an authenticated attacker to modify the C:\\Users\\DEFAULT folder structure, aka \"Windows Default Folder Tampering Vulnerability\"." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:N/I:P/A:N", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 2.1 }, "severity" : "LOW", "exploitabilityScore" : 3.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-06-15T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0296", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "rt", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-120" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98839", "name" : "98839", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0296", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0296", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to elevate privilege when tdx.sys fails to check the length of a buffer prior to copying memory to it, aka \"Windows TDX Elevation of Privilege Vulnerability\"." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:rt:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-06-15T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0297", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "rt", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98840", "name" : "98840", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038671", "name" : "1038671", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0297", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0297", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The kernel in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka \"Windows Kernel Information Disclosure Vulnerability,\" a different vulnerability than CVE-2017-8491, CVE-2017-8490, CVE-2017-8489, CVE-2017-8488, CVE-2017-8485, CVE-2017-8483, CVE-2017-8482, CVE-2017-8481, CVE-2017-8480, CVE-2017-8478, CVE-2017-8479, CVE-2017-8476, CVE-2017-8474, CVE-2017-8469, CVE-2017-8462, CVE-2017-0299, CVE-2017-0300." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:rt:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.0, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.3, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 1.9 }, "severity" : "LOW", "exploitabilityScore" : 3.4, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-15T01:29Z", "lastModifiedDate" : "2017-07-08T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0298", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "rt", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98841", "name" : "98841", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0298", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0298", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A DCOM object in Helppane.exe in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016, when configured to run as the interactive user, allows an authenticated attacker to run arbitrary code in another user's session, aka \"Windows COM Session Elevation of Privilege Vulnerability.\"" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:rt:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:gold:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.3, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.3, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 4.4 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.4, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-15T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0299", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "rt", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98884", "name" : "98884", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038671", "name" : "1038671", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0299", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0299", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/42219/", "name" : "42219", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka \"Windows Kernel Information Disclosure Vulnerability,\" a different vulnerability than CVE-2017-8491, CVE-2017-8490, CVE-2017-8489, CVE-2017-8488, CVE-2017-8485, CVE-2017-8483, CVE-2017-8482, CVE-2017-8481, CVE-2017-8480, CVE-2017-8478, CVE-2017-8479, CVE-2017-8476, CVE-2017-8474, CVE-2017-8469, CVE-2017-8462, CVE-2017-0300, and CVE-2017-0297." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:rt:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.0, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.3, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 1.9 }, "severity" : "LOW", "exploitabilityScore" : 3.4, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-15T01:29Z", "lastModifiedDate" : "2018-10-30T16:27Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0300", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "microsoft", "product" : { "product_data" : [ { "product_name" : "windows_10", "version" : { "version_data" : [ { "version_value" : "1511", "version_affected" : "=" }, { "version_value" : "1607", "version_affected" : "=" }, { "version_value" : "1703", "version_affected" : "=" } ] } }, { "product_name" : "windows_7", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } }, { "product_name" : "windows_8.1", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "rt", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2008", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2012", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "r2", "version_affected" : "=" } ] } }, { "product_name" : "windows_server_2016", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98901", "name" : "98901", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0300", "name" : "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0300", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/42244/", "name" : "42244", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka \"Windows Kernel Information Disclosure Vulnerability,\" a different vulnerability than CVE-2017-8491, CVE-2017-8490, CVE-2017-8489, CVE-2017-8488, CVE-2017-8485, CVE-2017-8483, CVE-2017-8482, CVE-2017-8481, CVE-2017-8480, CVE-2017-8478, CVE-2017-8479, CVE-2017-8476, CVE-2017-8474, CVE-2017-8469, CVE-2017-8462, CVE-2017-0299, and CVE-2017-0297." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_8.1:rt:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.0, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.3, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 1.9 }, "severity" : "LOW", "exploitabilityScore" : 3.4, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-15T01:29Z", "lastModifiedDate" : "2017-08-12T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0301", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "f5", "product" : { "product_data" : [ { "product_name" : "big-ip_access_policy_manager", "version" : { "version_data" : [ { "version_value" : "11.5.0", "version_affected" : "=" }, { "version_value" : "11.5.1", "version_affected" : "=" }, { "version_value" : "11.5.2", "version_affected" : "=" }, { "version_value" : "11.5.3", "version_affected" : "=" }, { "version_value" : "11.5.4", "version_affected" : "=" }, { "version_value" : "11.6.0", "version_affected" : "=" }, { "version_value" : "11.6.1", "version_affected" : "=" }, { "version_value" : "12.0.0", "version_affected" : "=" }, { "version_value" : "12.1.0", "version_affected" : "=" }, { "version_value" : "12.1.1", "version_affected" : "=" }, { "version_value" : "12.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securitytracker.com/id/1040040", "name" : "1040040", "refsource" : "SECTRACK", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://support.f5.com/csp/article/K54358225", "name" : "https://support.f5.com/csp/article/K54358225", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "In F5 BIG-IP APM software versions 11.5.0, 11.5.1, 11.5.2, 11.5.3, 11.5.4, 11.6.0, 11.6.1, 12.0.0, 12.1.0, 12.1.1 and 12.1.2 BIG-IP APM portal access requests do not return the intended resources in some cases. This may allow access to internal BIG-IP APM resources, however the application resources and backend servers are unaffected." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:12.0.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "LOW", "userInteraction" : "REQUIRED", "scope" : "CHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.6, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 0.9, "impactScore" : 6.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:H/Au:S/C:P/I:P/A:P", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "HIGH", "authentication" : "SINGLE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 4.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 2.5, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-12-21T17:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0302", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "f5", "product" : { "product_data" : [ { "product_name" : "big-ip_access_policy_manager", "version" : { "version_data" : [ { "version_value" : "12.0.0", "version_affected" : "=" }, { "version_value" : "12.1.0", "version_affected" : "=" }, { "version_value" : "12.1.1", "version_affected" : "=" }, { "version_value" : "12.1.2", "version_affected" : "=" }, { "version_value" : "13.0.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-118" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securitytracker.com/id/1038408", "name" : "1038408", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://support.f5.com/csp/article/K87141725", "name" : "https://support.f5.com/csp/article/K87141725", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "In F5 BIG-IP APM 12.0.0 through 12.1.2 and 13.0.0, an authenticated user with an established access session to the BIG-IP APM system may be able to cause a traffic disruption if the length of the requested URL is less than 16 characters." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:12.0.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:13.0.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.6, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:S/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 3.5 }, "severity" : "LOW", "exploitabilityScore" : 6.8, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-09T15:29Z", "lastModifiedDate" : "2017-07-08T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0303", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "f5", "product" : { "product_data" : [ { "product_name" : "big-ip_access_policy_manager", "version" : { "version_data" : [ { "version_value" : "11.5.0", "version_affected" : "=" }, { "version_value" : "11.5.1", "version_affected" : "=" }, { "version_value" : "11.5.2", "version_affected" : "=" }, { "version_value" : "11.5.3", "version_affected" : "=" }, { "version_value" : "11.5.4", "version_affected" : "=" }, { "version_value" : "11.5.5", "version_affected" : "=" }, { "version_value" : "11.6.0", "version_affected" : "=" }, { "version_value" : "11.6.1", "version_affected" : "=" }, { "version_value" : "12.0.0", "version_affected" : "=" }, { "version_value" : "12.1.0", "version_affected" : "=" }, { "version_value" : "12.1.1", "version_affected" : "=" }, { "version_value" : "12.1.2", "version_affected" : "=" }, { "version_value" : "13.0.0", "version_affected" : "=" } ] } }, { "product_name" : "big-ip_advanced_firewall_manager", "version" : { "version_data" : [ { "version_value" : "11.5.0", "version_affected" : "=" }, { "version_value" : "11.5.1", "version_affected" : "=" }, { "version_value" : "11.5.2", "version_affected" : "=" }, { "version_value" : "11.5.3", "version_affected" : "=" }, { "version_value" : "11.5.4", "version_affected" : "=" }, { "version_value" : "11.5.5", "version_affected" : "=" }, { "version_value" : "11.6.0", "version_affected" : "=" }, { "version_value" : "11.6.1", "version_affected" : "=" }, { "version_value" : "12.0.0", "version_affected" : "=" }, { "version_value" : "12.1.0", "version_affected" : "=" }, { "version_value" : "12.1.1", "version_affected" : "=" }, { "version_value" : "12.1.2", "version_affected" : "=" }, { "version_value" : "13.0.0", "version_affected" : "=" } ] } }, { "product_name" : "big-ip_application_acceleration_manager", "version" : { "version_data" : [ { "version_value" : "11.5.0", "version_affected" : "=" }, { "version_value" : "11.5.1", "version_affected" : "=" }, { "version_value" : "11.5.2", "version_affected" : "=" }, { "version_value" : "11.5.3", "version_affected" : "=" }, { "version_value" : "11.5.4", "version_affected" : "=" }, { "version_value" : "11.5.5", "version_affected" : "=" }, { "version_value" : "11.6.0", "version_affected" : "=" }, { "version_value" : "11.6.1", "version_affected" : "=" }, { "version_value" : "12.0.0", "version_affected" : "=" }, { "version_value" : "12.1.0", "version_affected" : "=" }, { "version_value" : "12.1.1", "version_affected" : "=" }, { "version_value" : "12.1.2", "version_affected" : "=" }, { "version_value" : "13.0.0", "version_affected" : "=" } ] } }, { "product_name" : "big-ip_application_security_manager", "version" : { "version_data" : [ { "version_value" : "11.5.0", "version_affected" : "=" }, { "version_value" : "11.5.1", "version_affected" : "=" }, { "version_value" : "11.5.2", "version_affected" : "=" }, { "version_value" : "11.5.3", "version_affected" : "=" }, { "version_value" : "11.5.4", "version_affected" : "=" }, { "version_value" : "11.5.5", "version_affected" : "=" }, { "version_value" : "11.6.0", "version_affected" : "=" }, { "version_value" : "11.6.1", "version_affected" : "=" }, { "version_value" : "12.0.0", "version_affected" : "=" }, { "version_value" : "12.1.0", "version_affected" : "=" }, { "version_value" : "12.1.1", "version_affected" : "=" }, { "version_value" : "12.1.2", "version_affected" : "=" }, { "version_value" : "13.0.0", "version_affected" : "=" } ] } }, { "product_name" : "big-ip_link_controller", "version" : { "version_data" : [ { "version_value" : "11.5.0", "version_affected" : "=" }, { "version_value" : "11.5.1", "version_affected" : "=" }, { "version_value" : "11.5.2", "version_affected" : "=" }, { "version_value" : "11.5.3", "version_affected" : "=" }, { "version_value" : "11.5.4", "version_affected" : "=" }, { "version_value" : "11.5.5", "version_affected" : "=" }, { "version_value" : "11.6.0", "version_affected" : "=" }, { "version_value" : "11.6.1", "version_affected" : "=" }, { "version_value" : "12.0.0", "version_affected" : "=" }, { "version_value" : "12.1.0", "version_affected" : "=" }, { "version_value" : "12.1.1", "version_affected" : "=" }, { "version_value" : "12.1.2", "version_affected" : "=" }, { "version_value" : "13.0.0", "version_affected" : "=" } ] } }, { "product_name" : "big-ip_local_traffic_manager", "version" : { "version_data" : [ { "version_value" : "11.5.0", "version_affected" : "=" }, { "version_value" : "11.5.1", "version_affected" : "=" }, { "version_value" : "11.5.2", "version_affected" : "=" }, { "version_value" : "11.5.3", "version_affected" : "=" }, { "version_value" : "11.5.4", "version_affected" : "=" }, { "version_value" : "11.5.5", "version_affected" : "=" }, { "version_value" : "11.6.0", "version_affected" : "=" }, { "version_value" : "11.6.1", "version_affected" : "=" }, { "version_value" : "12.0.0", "version_affected" : "=" }, { "version_value" : "12.1.0", "version_affected" : "=" }, { "version_value" : "12.1.1", "version_affected" : "=" }, { "version_value" : "12.1.2", "version_affected" : "=" }, { "version_value" : "13.0.0", "version_affected" : "=" } ] } }, { "product_name" : "big-ip_policy_enforcement_manager", "version" : { "version_data" : [ { "version_value" : "11.5.0", "version_affected" : "=" }, { "version_value" : "11.5.1", "version_affected" : "=" }, { "version_value" : "11.5.2", "version_affected" : "=" }, { "version_value" : "11.5.3", "version_affected" : "=" }, { "version_value" : "11.5.4", "version_affected" : "=" }, { "version_value" : "11.5.5", "version_affected" : "=" }, { "version_value" : "11.6.0", "version_affected" : "=" }, { "version_value" : "11.6.1", "version_affected" : "=" }, { "version_value" : "12.0.0", "version_affected" : "=" }, { "version_value" : "12.1.0", "version_affected" : "=" }, { "version_value" : "12.1.1", "version_affected" : "=" }, { "version_value" : "12.1.2", "version_affected" : "=" }, { "version_value" : "13.0.0", "version_affected" : "=" } ] } }, { "product_name" : "big-ip_websafe", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-459" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101612", "name" : "101612", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1039674", "name" : "1039674", "refsource" : "SECTRACK", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://support.f5.com/csp/article/K30201296", "name" : "https://support.f5.com/csp/article/K30201296", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, GTM, Link Controller, PEM and Websafe software version 13.0.0, 12.0.0 to 12.1.2 and 11.5.1 to 11.6.1, under limited circumstances connections handled by a Virtual Server with an associated SOCKS profile may not be properly cleaned up, potentially leading to resource starvation. Connections may be left in the connection table which then can only be removed by restarting TMM. Over time this may lead to the BIG-IP being unable to process further connections." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_local_traffic_manager:11.5.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_local_traffic_manager:11.6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_local_traffic_manager:11.6.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_local_traffic_manager:12.0.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_local_traffic_manager:12.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_local_traffic_manager:13.0.0:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.5.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_application_acceleration_manager:11.6.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.0.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_application_acceleration_manager:12.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_application_acceleration_manager:13.0.0:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.5.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:11.6.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.0.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:13.0.0:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:11.5.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:11.6.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:12.0.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:12.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_access_policy_manager:13.0.0:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_application_security_manager:11.5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_application_security_manager:11.5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_application_security_manager:11.5.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_application_security_manager:11.5.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_application_security_manager:11.5.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_application_security_manager:11.5.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_application_security_manager:11.6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_application_security_manager:11.6.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_application_security_manager:12.0.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_application_security_manager:12.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_application_security_manager:12.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_application_security_manager:12.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_application_security_manager:13.0.0:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_link_controller:11.5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_link_controller:11.5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_link_controller:11.5.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_link_controller:11.5.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_link_controller:11.5.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_link_controller:11.5.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_link_controller:11.6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_link_controller:11.6.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_link_controller:12.0.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_link_controller:12.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_link_controller:12.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_link_controller:12.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_link_controller:13.0.0:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.5.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:11.6.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:12.0.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:12.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:12.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:12.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:13.0.0:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_websafe:1.0.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-10-27T14:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0304", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "f5", "product" : { "product_data" : [ { "product_name" : "big-ip_advanced_firewall_manager", "version" : { "version_data" : [ { "version_value" : "12.0.0", "version_affected" : "=" }, { "version_value" : "12.1.0", "version_affected" : "=" }, { "version_value" : "12.1.1", "version_affected" : "=" }, { "version_value" : "12.1.2", "version_affected" : "=" }, { "version_value" : "13.0.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-89" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/102332", "name" : "102332", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1040041", "name" : "1040041", "refsource" : "SECTRACK", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://support.f5.com/csp/article/K39428424", "name" : "https://support.f5.com/csp/article/K39428424", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A SQL injection vulnerability exists in the BIG-IP AFM management UI on versions 12.0.0, 12.1.0, 12.1.1, 12.1.2 and 13.0.0 that may allow a copy of the firewall rules to be tampered with and impact the Configuration Utility until there is a resync of the rules. Traffic processing and the live firewall rules in use are not affected." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.0.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:12.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:13.0.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 5.4, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 2.5 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:S/C:P/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "SINGLE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 5.5 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.0, "impactScore" : 4.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-12-21T17:29Z", "lastModifiedDate" : "2018-01-08T15:32Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0305", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "f5", "product" : { "product_data" : [ { "product_name" : "ssl_intercept_iapp", "version" : { "version_data" : [ { "version_value" : "1.5.0", "version_affected" : "=" }, { "version_value" : "1.5.7", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://support.f5.com/csp/article/K53244431", "name" : "https://support.f5.com/csp/article/K53244431", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "F5 SSL Intercept iApp version 1.5.0 - 1.5.7 is vulnerable to an unauthenticated, remote attack that may allow modification of the BIG-IP system configuration, extraction of sensitive system files, and possible remote command execution on the system when deployed using the Explicit Proxy feature plus SNAT Auto Map option for egress traffic." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:ssl_intercept_iapp:1.5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:f5:ssl_intercept_iapp:1.5.7:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 9.8, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 3.9, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 7.5 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-06T14:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0306", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-120" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4561", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4561", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/96723", "name" : "96723", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10. Android ID: A-34132950. References: N-CVE-2017-0306." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0307", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-190" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4561", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4561", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/96809", "name" : "96809", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.18. Android ID: A-33177895. References: N-CVE-2017-0307." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0308", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where untrusted input is used for buffer size calculation leading to denial of service or escalation of privileges." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.0, "impactScore" : 6.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-02-15T23:59Z", "lastModifiedDate" : "2017-02-23T19:04Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0309", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-190" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where multiple integer overflows may cause improper memory allocation leading to a denial of service or potential escalation of privileges." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:freebsd:freebsd:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:oracle:solaris:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.0, "impactScore" : 6.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-02-15T23:59Z", "lastModifiedDate" : "2017-02-23T19:04Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0310", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-269" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where improper access controls allowing unprivileged user to cause a denial of service." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:freebsd:freebsd:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:oracle:solaris:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 6.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.0, "impactScore" : 4.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:N/I:N/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 4.9 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.9, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-02-15T23:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0311", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-732" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "NVIDIA GPU Display Driver R378 contains a vulnerability in the kernel mode layer handler where improper access control may lead to denial of service or possible escalation of privileges." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:freebsd:freebsd:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:oracle:solaris:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.0, "impactScore" : 6.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-02-15T23:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0312", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41364/", "name" : "41364", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscapeID 0x100008b where user provided input is used as the limit for a loop may lead to denial of service or potential escalation of privileges" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-02-15T23:59Z", "lastModifiedDate" : "2017-09-01T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0313", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41365/", "name" : "41365", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) implementation of the SubmitCommandVirtual DDI (DxgkDdiSubmitCommandVirtual) where untrusted input is used to reference memory outside of the intended boundary of the buffer leading to denial of service or escalation of privileges." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-02-15T23:59Z", "lastModifiedDate" : "2017-09-01T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0314", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) implementation of the SubmitCommandVirtual DDI (DxgkDdiSubmitCommandVirtual) where untrusted input is used to reference memory outside of the intended boundary of the buffer leading to denial of service or escalation of privileges." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-02-15T23:59Z", "lastModifiedDate" : "2017-02-23T19:26Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0315", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-476" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where an attempt to access an invalid object pointer may lead to denial of service or potential escalation of privileges." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-02-15T23:59Z", "lastModifiedDate" : "2017-02-23T19:26Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0316", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "geforce_experience", "version" : { "version_data" : [ { "version_value" : "3.0", "version_affected" : "=" }, { "version_value" : "3.0.6", "version_affected" : "=" }, { "version_value" : "3.0.7", "version_affected" : "=" }, { "version_value" : "3.1.0", "version_affected" : "=" }, { "version_value" : "3.1.2", "version_affected" : "=" }, { "version_value" : "3.2.0", "version_affected" : "=" }, { "version_value" : "3.2.2", "version_affected" : "=" }, { "version_value" : "3.3.0", "version_affected" : "=" }, { "version_value" : "3.4.0", "version_affected" : "=" }, { "version_value" : "3.5.0", "version_affected" : "=" }, { "version_value" : "3.6.0", "version_affected" : "=" }, { "version_value" : "3.7.0", "version_affected" : "=" }, { "version_value" : "3.8.0", "version_affected" : "=" }, { "version_value" : "3.9.0", "version_affected" : "=" }, { "version_value" : "3.10.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4560", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4560", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "In GeForce Experience (GFE) 3.x before 3.10.0.55, NVIDIA Installer Framework contains a vulnerability in NVISystemService64 where a value passed from a user to the driver is used without validation, which may lead to denial of service or possible escalation of privileges." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:geforce_experience:*:*:*:*:*:*:*:*", "versionStartIncluding" : "3.0", "versionEndExcluding" : "3.10.0.55" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 4.6 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.9, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-10-16T21:29Z", "lastModifiedDate" : "2019-11-07T18:12Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0317", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-732" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of NVIDIA GPU and GeForce Experience installer contain a vulnerability where it fails to set proper permissions on the package extraction path thus allowing a non-privileged user to tamper with the extracted files, potentially leading to escalation of privileges via code execution." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "LOW", "userInteraction" : "REQUIRED", "scope" : "CHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 0.8, "impactScore" : 6.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 6.9 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.4, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-15T23:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0318", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of NVIDIA Linux GPU Display Driver contain a vulnerability in the kernel mode layer handler where improper validation of an input parameter may cause a denial of service on the system." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:freebsd:freebsd:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:oracle:solaris:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:N/I:N/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 4.9 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.9, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-02-15T23:59Z", "lastModifiedDate" : "2017-02-23T19:08Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0319", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler where improper handling of values may cause a denial of service on the system." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:N/I:N/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 4.9 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.9, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-02-15T23:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0320", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler where improper handling of values may cause a denial of service on the system." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:N/I:N/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 4.9 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.9, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-02-15T23:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0321", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-476" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where a NULL pointer dereference caused by invalid user input may lead to denial of service or potential escalation of privileges." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:freebsd:freebsd:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" }, { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:oracle:solaris:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.0, "impactScore" : 6.0 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-02-15T23:59Z", "lastModifiedDate" : "2017-02-23T19:06Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0322", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-129" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler where a value passed from a user to the driver is not correctly validated and used as the index to an array, leading to denial of service or potential escalation of privileges." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-02-15T23:59Z", "lastModifiedDate" : "2017-02-23T19:30Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0323", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-476" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler where a NULL pointer dereference caused by invalid user input may lead to denial of service or potential escalation of privileges." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-02-15T23:59Z", "lastModifiedDate" : "2017-02-23T19:30Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0324", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4398", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the size of an input buffer is not validated, leading to denial of service or potential escalation of privileges." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-02-15T23:59Z", "lastModifiedDate" : "2017-02-23T19:30Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0325", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-787" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4561", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4561", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/97350", "name" : "97350", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01.html", "name" : "https://source.android.com/security/bulletin/2017-04-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the NVIDIA I2C HID driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel 3.10 and Kernel 3.18. Android ID: A-33040280. References: N-CVE-2017-0325." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-05T14:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0326", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4561", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4561", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/99477", "name" : "99477", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the NVIDIA Video Driver due to an out-of-bounds read function in the Tegra Display Controller driver could result in possible information disclosure. This issue is rated as Moderate. Product: Android. Version: N/A. Android ID: A-33718700. References: N-CVE-2017-0326." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-07T14:29Z", "lastModifiedDate" : "2017-10-19T01:30Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0327", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-120" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4561", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4561", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/97333", "name" : "97333", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01.html", "name" : "https://source.android.com/security/bulletin/2017-04-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the NVIDIA crypto driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel 3.10. Android ID: A-33893669. References: N-CVE-2017-0327." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-05T14:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0328", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97347", "name" : "97347", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01.html", "name" : "https://source.android.com/security/bulletin/2017-04-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the NVIDIA crypto driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel 3.10. Android ID: A-33898322. References: N-CVE-2017-0328." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-05T14:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0329", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97353", "name" : "97353", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01.html", "name" : "https://source.android.com/security/bulletin/2017-04-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the NVIDIA boot and power management processor driver could enable a local malicious application to execute arbitrary code within the context of the boot and power management processor. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel 3.18. Android ID:A-34115304. References: N-CVE-2017-0329." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-05T14:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0330", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97347", "name" : "97347", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://nvidia.custhelp.com/app/answers/detail/a_id/4787", "name" : "https://nvidia.custhelp.com/app/answers/detail/a_id/4787", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01.html", "name" : "https://source.android.com/security/bulletin/2017-04-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the NVIDIA crypto driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel 3.10. Android ID: A-33899858. References: N-CVE-2017-0330." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-05T14:59Z", "lastModifiedDate" : "2019-04-02T18:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0331", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-367" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4561", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4561", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/98150", "name" : "98150", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the NVIDIA video driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel 3.10. Android ID: A-34113000. References: N-CVE-2017-0331." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-02T21:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0332", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-787" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4561", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4561", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/97333", "name" : "97333", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01.html", "name" : "https://source.android.com/security/bulletin/2017-04-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the NVIDIA crypto driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel 3.10. Android ID: A-33812508. References: N-CVE-2017-0332." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-05T14:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0333", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96723", "name" : "96723", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.18. Android ID: A-33899363. References: N-CVE-2017-0333." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0334", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the NVIDIA GPU driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions: Kernel-3.18. Android ID: A-33245849. References: N-CVE-2017-0334." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0335", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96723", "name" : "96723", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.18. Android ID: A-33043375. References: N-CVE-2017-0335." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0336", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the NVIDIA GPU driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions: Kernel-3.18. Android ID: A-33042679. References: N-CVE-2017-0336." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0337", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96723", "name" : "96723", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.18. Android ID: A-31992762. References: N-CVE-2017-0337." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0338", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96723", "name" : "96723", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.18. Android ID: A-33057977. References: N-CVE-2017-0338." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0339", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97333", "name" : "97333", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01.html", "name" : "https://source.android.com/security/bulletin/2017-04-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the NVIDIA crypto driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel 3.10. Android ID: A-27930566. References: N-CVE-2017-0339." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-05T14:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0340", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99477", "name" : "99477", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the NVIDIA Libnvparser component due to a memcpy into a fixed sized buffer with a user-controlled size could lead to a memory corruption and possible remote code execution. This issue is rated as High. Product: Android. Version: N/A. Android ID: A-33968204. References: N-CVE-2017-0340." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-07T14:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0341", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-476" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where user provided input can trigger an access to a pointer that has not been initialized which may lead to denial of service or potential escalation of privileges." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-09T21:29Z", "lastModifiedDate" : "2017-05-17T18:58Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0342", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-682" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler where incorrect calculation may cause an invalid address access leading to denial of service or potential escalation of privileges." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-09T21:29Z", "lastModifiedDate" : "2017-05-17T19:01Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0343", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-362" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) where user can trigger a race condition due to lack of synchronization in two functions leading to a denial of service or potential escalation of privileges." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 6.9 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.4, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-09T21:29Z", "lastModifiedDate" : "2017-05-17T19:05Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0344", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape may allow users to gain access to arbitrary physical memory, leading to escalation of privileges." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0345", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-129" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where user provided input used as an array size is not correctly validated allows out of bound access in kernel memory and may lead to denial of service or potential escalation of privileges" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-09T21:29Z", "lastModifiedDate" : "2017-05-17T19:08Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0346", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "http://www.securityfocus.com/bid/98503", "name" : "98503", "refsource" : "BID", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the size of an input buffer is not validated, leading to denial of service or potential escalation of privileges." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-09T21:29Z", "lastModifiedDate" : "2017-05-25T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0347", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-129" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a value passed from a user to the driver is not correctly validated and used as the index to an array, which may lead to denial of service or potential escalation of privileges." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-09T21:29Z", "lastModifiedDate" : "2017-05-17T19:22Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0348", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-476" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler where a NULL pointer dereference may lead to denial of service or potential escalation of privileges." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-09T21:29Z", "lastModifiedDate" : "2017-05-17T19:22Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0349", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-476" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "http://www.securityfocus.com/bid/98513", "name" : "98513", "refsource" : "BID", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a pointer passed from a user to the driver is not correctly validated before it is dereferenced for a write operation, may lead to denial of service or potential escalation of privileges." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-09T21:29Z", "lastModifiedDate" : "2017-05-25T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0350", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "http://www.securityfocus.com/bid/98490", "name" : "98490", "refsource" : "BID", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where a value passed from a user to the driver is not correctly validated and used in an offset calculation may lead to denial of service or potential escalation of privileges." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-09T21:29Z", "lastModifiedDate" : "2017-06-05T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0351", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-476" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "http://www.securityfocus.com/bid/98497", "name" : "98497", "refsource" : "BID", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where a NULL pointer dereference caused by invalid user input may lead to denial of service or potential escalation of privileges." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-09T21:29Z", "lastModifiedDate" : "2017-06-05T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0352", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-732" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "http://www.securityfocus.com/bid/98517", "name" : "98517", "refsource" : "BID", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of the NVIDIA GPU Display Driver contain a vulnerability in the GPU firmware where incorrect access control may allow CPU access sensitive GPU control registers, leading to an escalation of privileges" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0353", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgDdiEscape where due to improper locking on certain conditions may lead to a denial of service" } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:N/I:N/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 4.9 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.9, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-09T21:29Z", "lastModifiedDate" : "2017-05-17T19:25Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0354", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgkDdiEscape where a call to certain function requiring lower IRQL can be made under raised IRQL which may lead to a denial of service." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 4.7 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.4, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-09T21:29Z", "lastModifiedDate" : "2017-05-17T19:26Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0355", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "gpu_driver", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4462", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "http://www.securityfocus.com/bid/98516", "name" : "98516", "refsource" : "BID", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer handler for DxgkDdiEscape where it may access paged memory while holding a spinlock, leading to a denial of service." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nvidia:gpu_driver:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:N/I:N/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 4.9 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.9, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-09T21:29Z", "lastModifiedDate" : "2017-05-25T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0356", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "ikiwiki", "product" : { "product_data" : [ { "product_name" : "ikiwiki", "version" : { "version_data" : [ { "version_value" : "1.0", "version_affected" : "=" }, { "version_value" : "1.1", "version_affected" : "=" }, { "version_value" : "1.1.47", "version_affected" : "=" }, { "version_value" : "1.2", "version_affected" : "=" }, { "version_value" : "1.3", "version_affected" : "=" }, { "version_value" : "1.4", "version_affected" : "=" }, { "version_value" : "1.5", "version_affected" : "=" }, { "version_value" : "1.6", "version_affected" : "=" }, { "version_value" : "1.7", "version_affected" : "=" }, { "version_value" : "1.8", "version_affected" : "=" }, { "version_value" : "1.9", "version_affected" : "=" }, { "version_value" : "1.10", "version_affected" : "=" }, { "version_value" : "1.11", "version_affected" : "=" }, { "version_value" : "1.12", "version_affected" : "=" }, { "version_value" : "1.13", "version_affected" : "=" }, { "version_value" : "1.14", "version_affected" : "=" }, { "version_value" : "1.15", "version_affected" : "=" }, { "version_value" : "1.16", "version_affected" : "=" }, { "version_value" : "1.17", "version_affected" : "=" }, { "version_value" : "1.18", "version_affected" : "=" }, { "version_value" : "1.19", "version_affected" : "=" }, { "version_value" : "1.20", "version_affected" : "=" }, { "version_value" : "1.21", "version_affected" : "=" }, { "version_value" : "1.22", "version_affected" : "=" }, { "version_value" : "1.23", "version_affected" : "=" }, { "version_value" : "1.24", "version_affected" : "=" }, { "version_value" : "1.25", "version_affected" : "=" }, { "version_value" : "1.26", "version_affected" : "=" }, { "version_value" : "1.27", "version_affected" : "=" }, { "version_value" : "1.28", "version_affected" : "=" }, { "version_value" : "1.29", "version_affected" : "=" }, { "version_value" : "1.30", "version_affected" : "=" }, { "version_value" : "1.31", "version_affected" : "=" }, { "version_value" : "1.32", "version_affected" : "=" }, { "version_value" : "1.33.3", "version_affected" : "=" }, { "version_value" : "1.34", "version_affected" : "=" }, { "version_value" : "1.34.1", "version_affected" : "=" }, { "version_value" : "1.34.2", "version_affected" : "=" }, { "version_value" : "1.35", "version_affected" : "=" }, { "version_value" : "1.36", "version_affected" : "=" }, { "version_value" : "1.37", "version_affected" : "=" }, { "version_value" : "1.38", "version_affected" : "=" }, { "version_value" : "1.39", "version_affected" : "=" }, { "version_value" : "1.40", "version_affected" : "=" }, { "version_value" : "1.41", "version_affected" : "=" }, { "version_value" : "1.42", "version_affected" : "=" }, { "version_value" : "1.43", "version_affected" : "=" }, { "version_value" : "1.44", "version_affected" : "=" }, { "version_value" : "1.45", "version_affected" : "=" }, { "version_value" : "1.46", "version_affected" : "=" }, { "version_value" : "1.47", "version_affected" : "=" }, { "version_value" : "1.48", "version_affected" : "=" }, { "version_value" : "1.49", "version_affected" : "=" }, { "version_value" : "1.50", "version_affected" : "=" }, { "version_value" : "1.51", "version_affected" : "=" }, { "version_value" : "2.0", "version_affected" : "=" }, { "version_value" : "2.00", "version_affected" : "=" }, { "version_value" : "2.1", "version_affected" : "=" }, { "version_value" : "2.2", "version_affected" : "=" }, { "version_value" : "2.3", "version_affected" : "=" }, { "version_value" : "2.4", "version_affected" : "=" }, { "version_value" : "2.5", "version_affected" : "=" }, { "version_value" : "2.6", "version_affected" : "=" }, { "version_value" : "2.6.1", "version_affected" : "=" }, { "version_value" : "2.7", "version_affected" : "=" }, { "version_value" : "2.8", "version_affected" : "=" }, { "version_value" : "2.9", "version_affected" : "=" }, { "version_value" : "2.10", "version_affected" : "=" }, { "version_value" : "2.11", "version_affected" : "=" }, { "version_value" : "2.12", "version_affected" : "=" }, { "version_value" : "2.13", "version_affected" : "=" }, { "version_value" : "2.14", "version_affected" : "=" }, { "version_value" : "2.15", "version_affected" : "=" }, { "version_value" : "2.16", "version_affected" : "=" }, { "version_value" : "2.17", "version_affected" : "=" }, { "version_value" : "2.18", "version_affected" : "=" }, { "version_value" : "2.19", "version_affected" : "=" }, { "version_value" : "2.20", "version_affected" : "=" }, { "version_value" : "2.30", "version_affected" : "=" }, { "version_value" : "2.31", "version_affected" : "=" }, { "version_value" : "2.31.1", "version_affected" : "=" }, { "version_value" : "2.31.2", "version_affected" : "=" }, { "version_value" : "2.31.3", "version_affected" : "=" }, { "version_value" : "2.40", "version_affected" : "=" }, { "version_value" : "2.41", "version_affected" : "=" }, { "version_value" : "2.42", "version_affected" : "=" }, { "version_value" : "2.43", "version_affected" : "=" }, { "version_value" : "2.44", "version_affected" : "=" }, { "version_value" : "2.45", "version_affected" : "=" }, { "version_value" : "2.46", "version_affected" : "=" }, { "version_value" : "2.47", "version_affected" : "=" }, { "version_value" : "2.48", "version_affected" : "=" }, { "version_value" : "2.49", "version_affected" : "=" }, { "version_value" : "2.50", "version_affected" : "=" }, { "version_value" : "2.51", "version_affected" : "=" }, { "version_value" : "2.52", "version_affected" : "=" }, { "version_value" : "2.53", "version_affected" : "=" }, { "version_value" : "2.54", "version_affected" : "=" }, { "version_value" : "2.55", "version_affected" : "=" }, { "version_value" : "2.56", "version_affected" : "=" }, { "version_value" : "2.60", "version_affected" : "=" }, { "version_value" : "2.61", "version_affected" : "=" }, { "version_value" : "2.62", "version_affected" : "=" }, { "version_value" : "2.62.1", "version_affected" : "=" }, { "version_value" : "2.63", "version_affected" : "=" }, { "version_value" : "2.64", "version_affected" : "=" }, { "version_value" : "2.65", "version_affected" : "=" }, { "version_value" : "2.66", "version_affected" : "=" }, { "version_value" : "2.67", "version_affected" : "=" }, { "version_value" : "2.68", "version_affected" : "=" }, { "version_value" : "2.69", "version_affected" : "=" }, { "version_value" : "2.70", "version_affected" : "=" }, { "version_value" : "2.71", "version_affected" : "=" }, { "version_value" : "2.72", "version_affected" : "=" }, { "version_value" : "3.0", "version_affected" : "=" }, { "version_value" : "3.00", "version_affected" : "=" }, { "version_value" : "3.01", "version_affected" : "=" }, { "version_value" : "3.02", "version_affected" : "=" }, { "version_value" : "3.03", "version_affected" : "=" }, { "version_value" : "3.04", "version_affected" : "=" }, { "version_value" : "3.05", "version_affected" : "=" }, { "version_value" : "3.06", "version_affected" : "=" }, { "version_value" : "3.07", "version_affected" : "=" }, { "version_value" : "3.08", "version_affected" : "=" }, { "version_value" : "3.09", "version_affected" : "=" }, { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.11", "version_affected" : "=" }, { "version_value" : "3.12", "version_affected" : "=" }, { "version_value" : "3.13", "version_affected" : "=" }, { "version_value" : "3.14", "version_affected" : "=" }, { "version_value" : "3.141", "version_affected" : "=" }, { "version_value" : "3.1415", "version_affected" : "=" }, { "version_value" : "3.14159", "version_affected" : "=" }, { "version_value" : "3.141592", "version_affected" : "=" }, { "version_value" : "3.1415926", "version_affected" : "=" }, { "version_value" : "3.14159265", "version_affected" : "=" }, { "version_value" : "3.20091009", "version_affected" : "=" }, { "version_value" : "3.20091017", "version_affected" : "=" }, { "version_value" : "3.20091022", "version_affected" : "=" }, { "version_value" : "3.20091023", "version_affected" : "=" }, { "version_value" : "3.20091031", "version_affected" : "=" }, { "version_value" : "3.20091113", "version_affected" : "=" }, { "version_value" : "3.20091202", "version_affected" : "=" }, { "version_value" : "3.20091218", "version_affected" : "=" }, { "version_value" : "3.20100102.3", "version_affected" : "=" }, { "version_value" : "3.20100122", "version_affected" : "=" }, { "version_value" : "3.20100212", "version_affected" : "=" }, { "version_value" : "3.20100302", "version_affected" : "=" }, { "version_value" : "3.20100312", "version_affected" : "=" }, { "version_value" : "3.20100403", "version_affected" : "=" }, { "version_value" : "3.20100427", "version_affected" : "=" }, { "version_value" : "3.20100501", "version_affected" : "=" }, { "version_value" : "3.20100504", "version_affected" : "=" }, { "version_value" : "3.20100515", "version_affected" : "=" }, { "version_value" : "3.20100518", "version_affected" : "=" }, { "version_value" : "3.20100518.2", "version_affected" : "=" }, { "version_value" : "3.20100610", "version_affected" : "=" }, { "version_value" : "3.20100623", "version_affected" : "=" }, { "version_value" : "3.20100722", "version_affected" : "=" }, { "version_value" : "3.20100804", "version_affected" : "=" }, { "version_value" : "3.20100815", "version_affected" : "=" }, { "version_value" : "3.20100831", "version_affected" : "=" }, { "version_value" : "3.20100926", "version_affected" : "=" }, { "version_value" : "3.20101019", "version_affected" : "=" }, { "version_value" : "3.20101023", "version_affected" : "=" }, { "version_value" : "3.20101112", "version_affected" : "=" }, { "version_value" : "3.20101129", "version_affected" : "=" }, { "version_value" : "3.20101201", "version_affected" : "=" }, { "version_value" : "3.20101231", "version_affected" : "=" }, { "version_value" : "3.20110105", "version_affected" : "=" }, { "version_value" : "3.20110122", "version_affected" : "=" }, { "version_value" : "3.20110123", "version_affected" : "=" }, { "version_value" : "3.20110124", "version_affected" : "=" }, { "version_value" : "3.20110225", "version_affected" : "=" }, { "version_value" : "3.20110321", "version_affected" : "=" }, { "version_value" : "3.20110328", "version_affected" : "=" }, { "version_value" : "3.20110430", "version_affected" : "=" }, { "version_value" : "3.20110431", "version_affected" : "=" }, { "version_value" : "3.20110608", "version_affected" : "=" }, { "version_value" : "3.20110707", "version_affected" : "=" }, { "version_value" : "3.20110711", "version_affected" : "=" }, { "version_value" : "3.20110712", "version_affected" : "=" }, { "version_value" : "3.20110715", "version_affected" : "=" }, { "version_value" : "3.20110905", "version_affected" : "=" }, { "version_value" : "3.20111106", "version_affected" : "=" }, { "version_value" : "3.20111107", "version_affected" : "=" }, { "version_value" : "3.20111229", "version_affected" : "=" }, { "version_value" : "3.20120109", "version_affected" : "=" }, { "version_value" : "3.20120115", "version_affected" : "=" }, { "version_value" : "3.20120202", "version_affected" : "=" }, { "version_value" : "3.20120203", "version_affected" : "=" }, { "version_value" : "3.20120419", "version_affected" : "=" }, { "version_value" : "3.20120516", "version_affected" : "=" }, { "version_value" : "3.20120629", "version_affected" : "=" }, { "version_value" : "3.20120725", "version_affected" : "=" }, { "version_value" : "3.20121016", "version_affected" : "=" }, { "version_value" : "3.20121017", "version_affected" : "=" }, { "version_value" : "3.20121212", "version_affected" : "=" }, { "version_value" : "3.20130212", "version_affected" : "=" }, { "version_value" : "3.20130504", "version_affected" : "=" }, { "version_value" : "3.20130518", "version_affected" : "=" }, { "version_value" : "3.20130710", "version_affected" : "=" }, { "version_value" : "3.20130711", "version_affected" : "=" }, { "version_value" : "3.20130904", "version_affected" : "=" }, { "version_value" : "3.20130904.1", "version_affected" : "=" }, { "version_value" : "3.20140102", "version_affected" : "=" }, { "version_value" : "3.20140125", "version_affected" : "=" }, { "version_value" : "3.20140227", "version_affected" : "=" }, { "version_value" : "3.20140613", "version_affected" : "=" }, { "version_value" : "3.20140815", "version_affected" : "=" }, { "version_value" : "3.20140831", "version_affected" : "=" }, { "version_value" : "3.20140916", "version_affected" : "=" }, { "version_value" : "3.20141016", "version_affected" : "=" }, { "version_value" : "3.20150107", "version_affected" : "=" }, { "version_value" : "3.20150329", "version_affected" : "=" }, { "version_value" : "3.20150610", "version_affected" : "=" }, { "version_value" : "3.20160121", "version_affected" : "=" }, { "version_value" : "3.20160506", "version_affected" : "=" }, { "version_value" : "3.20160509", "version_affected" : "=" }, { "version_value" : "3.20160728", "version_affected" : "=" }, { "version_value" : "3.20160905", "version_affected" : "=" }, { "version_value" : "3.20161219", "version_affected" : "=" }, { "version_value" : "3.20161229", "version_affected" : "=" }, { "version_value" : "3.20161229.1", "version_affected" : "=" }, { "version_value" : "3.20170110", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "debian", "product" : { "product_data" : [ { "product_name" : "debian_linux", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-287" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95420", "name" : "95420", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://ikiwiki.info/security/#cve-2017-0356", "name" : "https://ikiwiki.info/security/#cve-2017-0356", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://marc.info/?l=oss-security&m=148418234314276&w=2", "name" : "[oss-security] 20170112 ikiwiki: CVE-2017-0356: Authentication bypass via repeated parameters", "refsource" : "MLIST", "tags" : [ "Exploit", "Third Party Advisory" ] }, { "url" : "https://www.debian.org/security/2017/dsa-3760", "name" : "DSA-3760", "refsource" : "DEBIAN", "tags" : [ "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111, in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker to bypass authentication via repeated parameters." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:ikiwiki:ikiwiki:*:*:*:*:*:*:*:*", "versionEndExcluding" : "3.20170111" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 9.8, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 3.9, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 7.5 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.4, "acInsufInfo" : true, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2018-04-13T15:29Z", "lastModifiedDate" : "2018-05-18T15:40Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0357", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "iucode-tool_project", "product" : { "product_data" : [ { "product_name" : "iucode-tool", "version" : { "version_data" : [ { "version_value" : "1.4", "version_affected" : "=" }, { "version_value" : "1.5", "version_affected" : "=" }, { "version_value" : "1.5.1", "version_affected" : "=" }, { "version_value" : "1.5.2", "version_affected" : "=" }, { "version_value" : "1.6", "version_affected" : "=" }, { "version_value" : "1.6.1", "version_affected" : "=" }, { "version_value" : "2.0", "version_affected" : "=" }, { "version_value" : "2.1", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "debian", "product" : { "product_data" : [ { "product_name" : "debian_linux", "version" : { "version_data" : [ { "version_value" : "9.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95432", "name" : "95432", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://gitlab.com/iucode-tool/iucode-tool/issues/3", "name" : "https://gitlab.com/iucode-tool/iucode-tool/issues/3", "refsource" : "CONFIRM", "tags" : [ "Patch", "Third Party Advisory" ] }, { "url" : "https://security-tracker.debian.org/tracker/CVE-2017-0357", "name" : "https://security-tracker.debian.org/tracker/CVE-2017-0357", "refsource" : "CONFIRM", "tags" : [ "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A heap-overflow flaw exists in the -tr loader of iucode-tool starting with v1.4 and before v2.1.1, potentially leading to SIGSEGV, or heap corruption." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:iucode-tool_project:iucode-tool:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.4", "versionEndExcluding" : "2.1.1" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 9.8, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 3.9, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 7.5 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.4, "acInsufInfo" : true, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2018-04-13T15:29Z", "lastModifiedDate" : "2018-05-18T14:39Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0358", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "tuxera", "product" : { "product_data" : [ { "product_name" : "ntfs-3g", "version" : { "version_data" : [ { "version_value" : "2016.2.22", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "debian", "product" : { "product_data" : [ { "product_name" : "debian_linux", "version" : { "version_data" : [ { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-269" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.openwall.com/lists/oss-security/2017/02/04/1", "name" : "[oss-security] 20170203 Re: CVE-2017-0358 ntfs-3g: modprobe influence vulnerability via environment variables", "refsource" : "MLIST", "tags" : [ "Mailing List", "Third Party Advisory" ] }, { "url" : "http://www.securityfocus.com/bid/95987", "name" : "95987", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://marc.info/?l=oss-security&m=148594671929354&w=2", "name" : "[oss-security] 20170201 CVE-2017-0358 ntfs-3g: modprobe influence vulnerability via environment variables", "refsource" : "MLIST", "tags" : [ "Exploit", "Mailing List", "Third Party Advisory" ] }, { "url" : "https://security.gentoo.org/glsa/201702-10", "name" : "GLSA-201702-10", "refsource" : "GENTOO", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://www.debian.org/security/2017/dsa-3780", "name" : "DSA-3780", "refsource" : "DEBIAN", "tags" : [ ] }, { "url" : "https://www.exploit-db.com/exploits/41240/", "name" : "41240", "refsource" : "EXPLOIT-DB", "tags" : [ "Exploit", "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://www.exploit-db.com/exploits/41356/", "name" : "41356", "refsource" : "EXPLOIT-DB", "tags" : [ "Exploit", "Third Party Advisory", "VDB Entry" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tuxera:ntfs-3g:*:*:*:*:*:*:*:*", "versionEndIncluding" : "2016.2.22" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2018-04-13T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0359", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "reproducible_builds", "product" : { "product_data" : [ { "product_name" : "diffoscope", "version" : { "version_data" : [ { "version_value" : "1", "version_affected" : "=" }, { "version_value" : "2", "version_affected" : "=" }, { "version_value" : "3", "version_affected" : "=" }, { "version_value" : "4", "version_affected" : "=" }, { "version_value" : "5", "version_affected" : "=" }, { "version_value" : "6", "version_affected" : "=" }, { "version_value" : "7", "version_affected" : "=" }, { "version_value" : "8", "version_affected" : "=" }, { "version_value" : "9", "version_affected" : "=" }, { "version_value" : "10", "version_affected" : "=" }, { "version_value" : "11", "version_affected" : "=" }, { "version_value" : "12", "version_affected" : "=" }, { "version_value" : "13", "version_affected" : "=" }, { "version_value" : "14", "version_affected" : "=" }, { "version_value" : "15", "version_affected" : "=" }, { "version_value" : "16", "version_affected" : "=" }, { "version_value" : "17", "version_affected" : "=" }, { "version_value" : "18", "version_affected" : "=" }, { "version_value" : "19", "version_affected" : "=" }, { "version_value" : "20", "version_affected" : "=" }, { "version_value" : "21", "version_affected" : "=" }, { "version_value" : "22", "version_affected" : "=" }, { "version_value" : "23", "version_affected" : "=" }, { "version_value" : "24", "version_affected" : "=" }, { "version_value" : "25", "version_affected" : "=" }, { "version_value" : "26", "version_affected" : "=" }, { "version_value" : "27", "version_affected" : "=" }, { "version_value" : "28", "version_affected" : "=" }, { "version_value" : "29", "version_affected" : "=" }, { "version_value" : "30", "version_affected" : "=" }, { "version_value" : "31", "version_affected" : "=" }, { "version_value" : "32", "version_affected" : "=" }, { "version_value" : "33", "version_affected" : "=" }, { "version_value" : "34", "version_affected" : "=" }, { "version_value" : "35", "version_affected" : "=" }, { "version_value" : "36", "version_affected" : "=" }, { "version_value" : "37", "version_affected" : "=" }, { "version_value" : "38", "version_affected" : "=" }, { "version_value" : "39", "version_affected" : "=" }, { "version_value" : "40", "version_affected" : "=" }, { "version_value" : "41", "version_affected" : "=" }, { "version_value" : "42", "version_affected" : "=" }, { "version_value" : "43", "version_affected" : "=" }, { "version_value" : "44", "version_affected" : "=" }, { "version_value" : "45", "version_affected" : "=" }, { "version_value" : "46", "version_affected" : "=" }, { "version_value" : "47", "version_affected" : "=" }, { "version_value" : "48", "version_affected" : "=" }, { "version_value" : "49", "version_affected" : "=" }, { "version_value" : "50", "version_affected" : "=" }, { "version_value" : "51", "version_affected" : "=" }, { "version_value" : "52", "version_affected" : "=" }, { "version_value" : "53", "version_affected" : "=" }, { "version_value" : "54", "version_affected" : "=" }, { "version_value" : "55", "version_affected" : "=" }, { "version_value" : "56", "version_affected" : "=" }, { "version_value" : "57", "version_affected" : "=" }, { "version_value" : "58", "version_affected" : "=" }, { "version_value" : "59", "version_affected" : "=" }, { "version_value" : "60", "version_affected" : "=" }, { "version_value" : "61", "version_affected" : "=" }, { "version_value" : "62", "version_affected" : "=" }, { "version_value" : "63", "version_affected" : "=" }, { "version_value" : "64", "version_affected" : "=" }, { "version_value" : "65", "version_affected" : "=" }, { "version_value" : "66", "version_affected" : "=" }, { "version_value" : "67", "version_affected" : "=" }, { "version_value" : "68", "version_affected" : "=" }, { "version_value" : "69", "version_affected" : "=" }, { "version_value" : "70", "version_affected" : "=" }, { "version_value" : "71", "version_affected" : "=" }, { "version_value" : "72", "version_affected" : "=" }, { "version_value" : "73", "version_affected" : "=" }, { "version_value" : "74", "version_affected" : "=" }, { "version_value" : "75", "version_affected" : "=" }, { "version_value" : "76", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "debian", "product" : { "product_data" : [ { "product_name" : "debian_linux", "version" : { "version_data" : [ { "version_value" : "9.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://bugs.debian.org/854723", "name" : "https://bugs.debian.org/854723", "refsource" : "CONFIRM", "tags" : [ "Exploit", "Patch", "Third Party Advisory" ] }, { "url" : "https://security-tracker.debian.org/tracker/CVE-2017-0359", "name" : "https://security-tracker.debian.org/tracker/CVE-2017-0359", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:reproducible_builds:diffoscope:*:*:*:*:*:*:*:*", "versionEndExcluding" : "77" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 10.0 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 10.0, "acInsufInfo" : true, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2018-04-13T16:29Z", "lastModifiedDate" : "2019-12-03T18:57Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0360", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "tryton", "product" : { "product_data" : [ { "product_name" : "tryton", "version" : { "version_data" : [ { "version_value" : "3.0.0", "version_affected" : "=" }, { "version_value" : "3.0.1", "version_affected" : "=" }, { "version_value" : "3.0.2", "version_affected" : "=" }, { "version_value" : "3.0.3", "version_affected" : "=" }, { "version_value" : "3.0.4", "version_affected" : "=" }, { "version_value" : "3.0.5", "version_affected" : "=" }, { "version_value" : "3.0.6", "version_affected" : "=" }, { "version_value" : "3.0.7", "version_affected" : "=" }, { "version_value" : "3.0.8", "version_affected" : "=" }, { "version_value" : "3.0.9", "version_affected" : "=" }, { "version_value" : "3.0.10", "version_affected" : "=" }, { "version_value" : "3.0.11", "version_affected" : "=" }, { "version_value" : "3.0.12", "version_affected" : "=" }, { "version_value" : "3.0.13", "version_affected" : "=" }, { "version_value" : "3.0.14", "version_affected" : "=" }, { "version_value" : "3.0.15", "version_affected" : "=" }, { "version_value" : "3.0.16", "version_affected" : "=" }, { "version_value" : "3.0.17", "version_affected" : "=" }, { "version_value" : "3.2.0", "version_affected" : "=" }, { "version_value" : "3.2.1", "version_affected" : "=" }, { "version_value" : "3.2.2", "version_affected" : "=" }, { "version_value" : "3.2.3", "version_affected" : "=" }, { "version_value" : "3.2.4", "version_affected" : "=" }, { "version_value" : "3.2.5", "version_affected" : "=" }, { "version_value" : "3.2.6", "version_affected" : "=" }, { "version_value" : "3.2.7", "version_affected" : "=" }, { "version_value" : "3.2.8", "version_affected" : "=" }, { "version_value" : "3.2.9", "version_affected" : "=" }, { "version_value" : "3.2.10", "version_affected" : "=" }, { "version_value" : "3.2.11", "version_affected" : "=" }, { "version_value" : "3.2.12", "version_affected" : "=" }, { "version_value" : "3.2.13", "version_affected" : "=" }, { "version_value" : "3.2.14", "version_affected" : "=" }, { "version_value" : "3.2.15", "version_affected" : "=" }, { "version_value" : "3.2.16", "version_affected" : "=" }, { "version_value" : "3.2.17", "version_affected" : "=" }, { "version_value" : "3.4.0", "version_affected" : "=" }, { "version_value" : "3.4.1", "version_affected" : "=" }, { "version_value" : "3.4.2", "version_affected" : "=" }, { "version_value" : "3.4.3", "version_affected" : "=" }, { "version_value" : "3.4.4", "version_affected" : "=" }, { "version_value" : "3.4.5", "version_affected" : "=" }, { "version_value" : "3.4.6", "version_affected" : "=" }, { "version_value" : "3.4.7", "version_affected" : "=" }, { "version_value" : "3.4.8", "version_affected" : "=" }, { "version_value" : "3.4.9", "version_affected" : "=" }, { "version_value" : "3.4.10", "version_affected" : "=" }, { "version_value" : "3.4.11", "version_affected" : "=" }, { "version_value" : "3.4.12", "version_affected" : "=" }, { "version_value" : "3.4.13", "version_affected" : "=" }, { "version_value" : "3.4.14", "version_affected" : "=" }, { "version_value" : "3.4.15", "version_affected" : "=" }, { "version_value" : "3.4.16", "version_affected" : "=" }, { "version_value" : "3.4.17", "version_affected" : "=" }, { "version_value" : "3.6.0", "version_affected" : "=" }, { "version_value" : "3.6.1", "version_affected" : "=" }, { "version_value" : "3.6.2", "version_affected" : "=" }, { "version_value" : "3.6.3", "version_affected" : "=" }, { "version_value" : "3.6.4", "version_affected" : "=" }, { "version_value" : "3.6.5", "version_affected" : "=" }, { "version_value" : "3.6.6", "version_affected" : "=" }, { "version_value" : "3.6.7", "version_affected" : "=" }, { "version_value" : "3.6.8", "version_affected" : "=" }, { "version_value" : "3.6.9", "version_affected" : "=" }, { "version_value" : "3.6.10", "version_affected" : "=" }, { "version_value" : "3.6.11", "version_affected" : "=" }, { "version_value" : "3.6.12", "version_affected" : "=" }, { "version_value" : "3.6.13", "version_affected" : "=" }, { "version_value" : "3.6.14", "version_affected" : "=" }, { "version_value" : "3.6.15", "version_affected" : "=" }, { "version_value" : "3.6.16", "version_affected" : "=" }, { "version_value" : "3.8.0", "version_affected" : "=" }, { "version_value" : "3.8.1", "version_affected" : "=" }, { "version_value" : "3.8.2", "version_affected" : "=" }, { "version_value" : "3.8.3", "version_affected" : "=" }, { "version_value" : "3.8.4", "version_affected" : "=" }, { "version_value" : "3.8.5", "version_affected" : "=" }, { "version_value" : "3.8.6", "version_affected" : "=" }, { "version_value" : "3.8.7", "version_affected" : "=" }, { "version_value" : "3.8.8", "version_affected" : "=" }, { "version_value" : "3.8.9", "version_affected" : "=" }, { "version_value" : "3.8.10", "version_affected" : "=" }, { "version_value" : "3.8.11", "version_affected" : "=" }, { "version_value" : "3.8.12", "version_affected" : "=" }, { "version_value" : "3.8.13", "version_affected" : "=" }, { "version_value" : "3.8.14", "version_affected" : "=" }, { "version_value" : "4.0.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.0.5", "version_affected" : "=" }, { "version_value" : "4.0.6", "version_affected" : "=" }, { "version_value" : "4.0.7", "version_affected" : "=" }, { "version_value" : "4.0.8", "version_affected" : "=" }, { "version_value" : "4.0.9", "version_affected" : "=" }, { "version_value" : "4.2.0", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-269" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://hg.tryton.org/trytond?cmd=changeset;node=472510fdc6f8", "name" : "http://hg.tryton.org/trytond?cmd=changeset;node=472510fdc6f8", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking" ] }, { "url" : "http://www.debian.org/security/2017/dsa-3826", "name" : "DSA-3826", "refsource" : "DEBIAN", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/97489", "name" : "97489", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://lists.debian.org/debian-security-announce/2017/msg00084.html", "name" : "https://lists.debian.org/debian-security-announce/2017/msg00084.html", "refsource" : "CONFIRM", "tags" : [ "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a \"same root name but with a suffix\" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.0.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.0.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.0.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.0.7:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.0.8:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.0.9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.0.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.0.11:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.0.12:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.0.13:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.0.14:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.0.15:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.0.16:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.0.17:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.2.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.2.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.2.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.2.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.2.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.2.7:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.2.8:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.2.9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.2.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.2.11:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.2.12:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.2.13:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.2.14:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.2.15:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.2.16:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.2.17:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.4.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.4.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.4.7:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.4.8:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.4.9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.4.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.4.11:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.4.12:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.4.13:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.4.14:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.4.15:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.4.16:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.4.17:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.6.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.6.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.6.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.6.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.6.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.6.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.6.7:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.6.8:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.6.9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.6.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.6.11:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.6.12:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.6.13:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.6.14:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.6.15:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.6.16:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.8.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.8.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.8.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.8.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.8.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.8.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.8.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.8.7:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.8.8:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.8.9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.8.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.8.11:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.8.12:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.8.13:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:3.8.14:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:4.0.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:4.0.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:4.0.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:4.0.7:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:4.0.8:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:4.0.9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:4.2.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:tryton:tryton:4.2.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.6, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:S/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 3.5 }, "severity" : "LOW", "exploitabilityScore" : 6.8, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-04T17:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0361", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "mediawiki", "product" : { "product_data" : [ { "product_name" : "mediawiki", "version" : { "version_data" : [ { "version_value" : "1.23.0", "version_affected" : "=" }, { "version_value" : "1.23.1", "version_affected" : "=" }, { "version_value" : "1.23.2", "version_affected" : "=" }, { "version_value" : "1.23.3", "version_affected" : "=" }, { "version_value" : "1.23.4", "version_affected" : "=" }, { "version_value" : "1.23.5", "version_affected" : "=" }, { "version_value" : "1.23.6", "version_affected" : "=" }, { "version_value" : "1.23.7", "version_affected" : "=" }, { "version_value" : "1.23.8", "version_affected" : "=" }, { "version_value" : "1.23.9", "version_affected" : "=" }, { "version_value" : "1.23.10", "version_affected" : "=" }, { "version_value" : "1.23.11", "version_affected" : "=" }, { "version_value" : "1.23.12", "version_affected" : "=" }, { "version_value" : "1.23.13", "version_affected" : "=" }, { "version_value" : "1.23.14", "version_affected" : "=" }, { "version_value" : "1.23.15", "version_affected" : "=" }, { "version_value" : "1.23.16", "version_affected" : "=" }, { "version_value" : "1.27.0", "version_affected" : "=" }, { "version_value" : "1.27.1", "version_affected" : "=" }, { "version_value" : "1.28.0", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "debian", "product" : { "product_data" : [ { "product_name" : "debian_linux", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securitytracker.com/id/1039812", "name" : "1039812", "refsource" : "SECTRACK", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html", "name" : "[mediawiki-announce] 20170406 Security Release: 1.28.1 / 1.27.2 / 1.23.16", "refsource" : "MLIST", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://phabricator.wikimedia.org/T125177", "name" : "https://phabricator.wikimedia.org/T125177", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Third Party Advisory" ] }, { "url" : "https://security-tracker.debian.org/tracker/CVE-2017-0361", "name" : "https://security-tracker.debian.org/tracker/CVE-2017-0361", "refsource" : "CONFIRM", "tags" : [ "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains an information disclosure flaw, where the api.log might contain passwords in plaintext." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.23.0", "versionEndIncluding" : "1.23.16" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.27.0", "versionEndExcluding" : "1.27.2" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.28.0", "versionEndExcluding" : "1.28.1" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:P/I:N/A:N", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.1 }, "severity" : "LOW", "exploitabilityScore" : 3.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2018-04-13T16:29Z", "lastModifiedDate" : "2018-05-14T17:09Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0362", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "mediawiki", "product" : { "product_data" : [ { "product_name" : "mediawiki", "version" : { "version_data" : [ { "version_value" : "1.23.0", "version_affected" : "=" }, { "version_value" : "1.23.1", "version_affected" : "=" }, { "version_value" : "1.23.2", "version_affected" : "=" }, { "version_value" : "1.23.3", "version_affected" : "=" }, { "version_value" : "1.23.4", "version_affected" : "=" }, { "version_value" : "1.23.5", "version_affected" : "=" }, { "version_value" : "1.23.6", "version_affected" : "=" }, { "version_value" : "1.23.7", "version_affected" : "=" }, { "version_value" : "1.23.8", "version_affected" : "=" }, { "version_value" : "1.23.9", "version_affected" : "=" }, { "version_value" : "1.23.10", "version_affected" : "=" }, { "version_value" : "1.23.11", "version_affected" : "=" }, { "version_value" : "1.23.12", "version_affected" : "=" }, { "version_value" : "1.23.13", "version_affected" : "=" }, { "version_value" : "1.23.14", "version_affected" : "=" }, { "version_value" : "1.23.15", "version_affected" : "=" }, { "version_value" : "1.23.16", "version_affected" : "=" }, { "version_value" : "1.27.0", "version_affected" : "=" }, { "version_value" : "1.27.1", "version_affected" : "=" }, { "version_value" : "1.28.0", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "debian", "product" : { "product_data" : [ { "product_name" : "debian_linux", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-352" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html", "name" : "[mediawiki-announce] 20170406 Security Release: 1.28.1 / 1.27.2 / 1.23.16", "refsource" : "MLIST", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://phabricator.wikimedia.org/T150044", "name" : "https://phabricator.wikimedia.org/T150044", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Third Party Advisory" ] }, { "url" : "https://security-tracker.debian.org/tracker/CVE-2017-0362", "name" : "https://security-tracker.debian.org/tracker/CVE-2017-0362", "refsource" : "CONFIRM", "tags" : [ "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where the \"Mark all pages visited\" on the watchlist does not require a CSRF token." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.23.0", "versionEndIncluding" : "1.23.16" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.27.0", "versionEndExcluding" : "1.27.2" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.28.0", "versionEndExcluding" : "1.28.1" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2018-04-13T16:29Z", "lastModifiedDate" : "2018-05-15T13:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0363", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "mediawiki", "product" : { "product_data" : [ { "product_name" : "mediawiki", "version" : { "version_data" : [ { "version_value" : "1.23.0", "version_affected" : "=" }, { "version_value" : "1.23.1", "version_affected" : "=" }, { "version_value" : "1.23.2", "version_affected" : "=" }, { "version_value" : "1.23.3", "version_affected" : "=" }, { "version_value" : "1.23.4", "version_affected" : "=" }, { "version_value" : "1.23.5", "version_affected" : "=" }, { "version_value" : "1.23.6", "version_affected" : "=" }, { "version_value" : "1.23.7", "version_affected" : "=" }, { "version_value" : "1.23.8", "version_affected" : "=" }, { "version_value" : "1.23.9", "version_affected" : "=" }, { "version_value" : "1.23.10", "version_affected" : "=" }, { "version_value" : "1.23.11", "version_affected" : "=" }, { "version_value" : "1.23.12", "version_affected" : "=" }, { "version_value" : "1.23.13", "version_affected" : "=" }, { "version_value" : "1.23.14", "version_affected" : "=" }, { "version_value" : "1.23.15", "version_affected" : "=" }, { "version_value" : "1.23.16", "version_affected" : "=" }, { "version_value" : "1.27.0", "version_affected" : "=" }, { "version_value" : "1.27.1", "version_affected" : "=" }, { "version_value" : "1.28.0", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "debian", "product" : { "product_data" : [ { "product_name" : "debian_linux", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-601" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html", "name" : "[mediawiki-announce] 20170406 Security Release: 1.28.1 / 1.27.2 / 1.23.16", "refsource" : "MLIST", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://phabricator.wikimedia.org/T109140", "name" : "https://phabricator.wikimedia.org/T109140", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Third Party Advisory" ] }, { "url" : "https://security-tracker.debian.org/tracker/CVE-2017-0363", "name" : "https://security-tracker.debian.org/tracker/CVE-2017-0363", "refsource" : "CONFIRM", "tags" : [ "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 has a flaw where Special:UserLogin?returnto=interwiki:foo will redirect to external sites." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.23.0", "versionEndIncluding" : "1.23.16" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.27.0", "versionEndExcluding" : "1.27.2" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.28.0", "versionEndExcluding" : "1.28.1" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "CHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 6.1, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 2.7 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 5.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 4.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2018-04-13T16:29Z", "lastModifiedDate" : "2018-05-14T15:20Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0364", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "mediawiki", "product" : { "product_data" : [ { "product_name" : "mediawiki", "version" : { "version_data" : [ { "version_value" : "1.23.0", "version_affected" : "=" }, { "version_value" : "1.23.1", "version_affected" : "=" }, { "version_value" : "1.23.2", "version_affected" : "=" }, { "version_value" : "1.23.3", "version_affected" : "=" }, { "version_value" : "1.23.4", "version_affected" : "=" }, { "version_value" : "1.23.5", "version_affected" : "=" }, { "version_value" : "1.23.6", "version_affected" : "=" }, { "version_value" : "1.23.7", "version_affected" : "=" }, { "version_value" : "1.23.8", "version_affected" : "=" }, { "version_value" : "1.23.9", "version_affected" : "=" }, { "version_value" : "1.23.10", "version_affected" : "=" }, { "version_value" : "1.23.11", "version_affected" : "=" }, { "version_value" : "1.23.12", "version_affected" : "=" }, { "version_value" : "1.23.13", "version_affected" : "=" }, { "version_value" : "1.23.14", "version_affected" : "=" }, { "version_value" : "1.23.15", "version_affected" : "=" }, { "version_value" : "1.23.16", "version_affected" : "=" }, { "version_value" : "1.27.0", "version_affected" : "=" }, { "version_value" : "1.27.1", "version_affected" : "=" }, { "version_value" : "1.28.0", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "debian", "product" : { "product_data" : [ { "product_name" : "debian_linux", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-601" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html", "name" : "[mediawiki-announce] 20170406 Security Release: 1.28.1 / 1.27.2 / 1.23.16", "refsource" : "MLIST", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://phabricator.wikimedia.org/T122209", "name" : "https://phabricator.wikimedia.org/T122209", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Third Party Advisory" ] }, { "url" : "https://security-tracker.debian.org/tracker/CVE-2017-0364", "name" : "https://security-tracker.debian.org/tracker/CVE-2017-0364", "refsource" : "CONFIRM", "tags" : [ "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where Special:Search allows redirects to any interwiki link." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.23.0", "versionEndIncluding" : "1.23.16" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.27.0", "versionEndExcluding" : "1.27.2" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.28.0", "versionEndExcluding" : "1.28.1" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "CHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 6.1, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 2.7 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 5.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 4.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2018-04-13T16:29Z", "lastModifiedDate" : "2018-05-14T15:26Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0365", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "mediawiki", "product" : { "product_data" : [ { "product_name" : "mediawiki", "version" : { "version_data" : [ { "version_value" : "1.23.0", "version_affected" : "=" }, { "version_value" : "1.23.1", "version_affected" : "=" }, { "version_value" : "1.23.2", "version_affected" : "=" }, { "version_value" : "1.23.3", "version_affected" : "=" }, { "version_value" : "1.23.4", "version_affected" : "=" }, { "version_value" : "1.23.5", "version_affected" : "=" }, { "version_value" : "1.23.6", "version_affected" : "=" }, { "version_value" : "1.23.7", "version_affected" : "=" }, { "version_value" : "1.23.8", "version_affected" : "=" }, { "version_value" : "1.23.9", "version_affected" : "=" }, { "version_value" : "1.23.10", "version_affected" : "=" }, { "version_value" : "1.23.11", "version_affected" : "=" }, { "version_value" : "1.23.12", "version_affected" : "=" }, { "version_value" : "1.23.13", "version_affected" : "=" }, { "version_value" : "1.23.14", "version_affected" : "=" }, { "version_value" : "1.23.15", "version_affected" : "=" }, { "version_value" : "1.23.16", "version_affected" : "=" }, { "version_value" : "1.27.0", "version_affected" : "=" }, { "version_value" : "1.27.1", "version_affected" : "=" }, { "version_value" : "1.28.0", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "debian", "product" : { "product_data" : [ { "product_name" : "debian_linux", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-79" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html", "name" : "[mediawiki-announce] 20170406 Security Release: 1.28.1 / 1.27.2 / 1.23.16", "refsource" : "MLIST", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://phabricator.wikimedia.org/T144845", "name" : "https://phabricator.wikimedia.org/T144845", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Third Party Advisory" ] }, { "url" : "https://security-tracker.debian.org/tracker/CVE-2017-0365", "name" : "https://security-tracker.debian.org/tracker/CVE-2017-0365", "refsource" : "CONFIRM", "tags" : [ "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a XSS vulnerability in SearchHighlighter::highlightText() with non-default configurations." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.23.0", "versionEndIncluding" : "1.23.16" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.27.0", "versionEndExcluding" : "1.27.2" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.28.0", "versionEndExcluding" : "1.28.1" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "CHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.6, "impactScore" : 2.7 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2018-04-13T16:29Z", "lastModifiedDate" : "2018-05-14T14:42Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0366", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "mediawiki", "product" : { "product_data" : [ { "product_name" : "mediawiki", "version" : { "version_data" : [ { "version_value" : "1.23.0", "version_affected" : "=" }, { "version_value" : "1.23.1", "version_affected" : "=" }, { "version_value" : "1.23.2", "version_affected" : "=" }, { "version_value" : "1.23.3", "version_affected" : "=" }, { "version_value" : "1.23.4", "version_affected" : "=" }, { "version_value" : "1.23.5", "version_affected" : "=" }, { "version_value" : "1.23.6", "version_affected" : "=" }, { "version_value" : "1.23.7", "version_affected" : "=" }, { "version_value" : "1.23.8", "version_affected" : "=" }, { "version_value" : "1.23.9", "version_affected" : "=" }, { "version_value" : "1.23.10", "version_affected" : "=" }, { "version_value" : "1.23.11", "version_affected" : "=" }, { "version_value" : "1.23.12", "version_affected" : "=" }, { "version_value" : "1.23.13", "version_affected" : "=" }, { "version_value" : "1.23.14", "version_affected" : "=" }, { "version_value" : "1.23.15", "version_affected" : "=" }, { "version_value" : "1.23.16", "version_affected" : "=" }, { "version_value" : "1.27.0", "version_affected" : "=" }, { "version_value" : "1.27.1", "version_affected" : "=" }, { "version_value" : "1.28.0", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "debian", "product" : { "product_data" : [ { "product_name" : "debian_linux", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html", "name" : "[mediawiki-announce] 20170406 Security Release: 1.28.1 / 1.27.2 / 1.23.16", "refsource" : "MLIST", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://phabricator.wikimedia.org/T151735", "name" : "https://phabricator.wikimedia.org/T151735", "refsource" : "CONFIRM", "tags" : [ "Exploit", "Issue Tracking", "Third Party Advisory" ] }, { "url" : "https://security-tracker.debian.org/tracker/CVE-2017-0366", "name" : "https://security-tracker.debian.org/tracker/CVE-2017-0366", "refsource" : "CONFIRM", "tags" : [ "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw allowing to evade SVG filter using default attribute values in DTD declaration." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.23.0", "versionEndIncluding" : "1.23.16" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.27.0", "versionEndExcluding" : "1.27.2" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.28.0", "versionEndExcluding" : "1.28.1" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 5.4, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 2.5 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:S/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "SINGLE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2018-04-13T16:29Z", "lastModifiedDate" : "2018-05-14T15:28Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0367", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "mediawiki", "product" : { "product_data" : [ { "product_name" : "mediawiki", "version" : { "version_data" : [ { "version_value" : "1.27.0", "version_affected" : "=" }, { "version_value" : "1.27.1", "version_affected" : "=" }, { "version_value" : "1.28.0", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "debian", "product" : { "product_data" : [ { "product_name" : "debian_linux", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-668" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html", "name" : "[mediawiki-announce] 20170406 Security Release: 1.28.1 / 1.27.2 / 1.23.16", "refsource" : "MLIST", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://phabricator.wikimedia.org/T161453", "name" : "https://phabricator.wikimedia.org/T161453", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Third Party Advisory" ] }, { "url" : "https://security-tracker.debian.org/tracker/CVE-2017-0367", "name" : "https://security-tracker.debian.org/tracker/CVE-2017-0367", "refsource" : "CONFIRM", "tags" : [ "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is insecure." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.27.0", "versionEndExcluding" : "1.27.2" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.28.0", "versionEndExcluding" : "1.28.1" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:S/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "SINGLE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.5 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.0, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2018-04-13T16:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0368", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "mediawiki", "product" : { "product_data" : [ { "product_name" : "mediawiki", "version" : { "version_data" : [ { "version_value" : "1.23.0", "version_affected" : "=" }, { "version_value" : "1.23.1", "version_affected" : "=" }, { "version_value" : "1.23.2", "version_affected" : "=" }, { "version_value" : "1.23.3", "version_affected" : "=" }, { "version_value" : "1.23.4", "version_affected" : "=" }, { "version_value" : "1.23.5", "version_affected" : "=" }, { "version_value" : "1.23.6", "version_affected" : "=" }, { "version_value" : "1.23.7", "version_affected" : "=" }, { "version_value" : "1.23.8", "version_affected" : "=" }, { "version_value" : "1.23.9", "version_affected" : "=" }, { "version_value" : "1.23.10", "version_affected" : "=" }, { "version_value" : "1.23.11", "version_affected" : "=" }, { "version_value" : "1.23.12", "version_affected" : "=" }, { "version_value" : "1.23.13", "version_affected" : "=" }, { "version_value" : "1.23.14", "version_affected" : "=" }, { "version_value" : "1.23.15", "version_affected" : "=" }, { "version_value" : "1.23.16", "version_affected" : "=" }, { "version_value" : "1.27.0", "version_affected" : "=" }, { "version_value" : "1.27.1", "version_affected" : "=" }, { "version_value" : "1.28.0", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "debian", "product" : { "product_data" : [ { "product_name" : "debian_linux", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html", "name" : "[mediawiki-announce] 20170406 Security Release: 1.28.1 / 1.27.2 / 1.23.16", "refsource" : "MLIST", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://phabricator.wikimedia.org/T156184", "name" : "https://phabricator.wikimedia.org/T156184", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Third Party Advisory" ] }, { "url" : "https://security-tracker.debian.org/tracker/CVE-2017-0368", "name" : "https://security-tracker.debian.org/tracker/CVE-2017-0368", "refsource" : "CONFIRM", "tags" : [ "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw making rawHTML mode apply to system messages." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.23.0", "versionEndIncluding" : "1.23.16" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.27.0", "versionEndExcluding" : "1.27.2" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.28.0", "versionEndExcluding" : "1.28.1" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 5.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 3.9, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2018-04-13T16:29Z", "lastModifiedDate" : "2018-05-14T15:35Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0369", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "mediawiki", "product" : { "product_data" : [ { "product_name" : "mediawiki", "version" : { "version_data" : [ { "version_value" : "1.23.0", "version_affected" : "=" }, { "version_value" : "1.23.1", "version_affected" : "=" }, { "version_value" : "1.23.2", "version_affected" : "=" }, { "version_value" : "1.23.3", "version_affected" : "=" }, { "version_value" : "1.23.4", "version_affected" : "=" }, { "version_value" : "1.23.5", "version_affected" : "=" }, { "version_value" : "1.23.6", "version_affected" : "=" }, { "version_value" : "1.23.7", "version_affected" : "=" }, { "version_value" : "1.23.8", "version_affected" : "=" }, { "version_value" : "1.23.9", "version_affected" : "=" }, { "version_value" : "1.23.10", "version_affected" : "=" }, { "version_value" : "1.23.11", "version_affected" : "=" }, { "version_value" : "1.23.12", "version_affected" : "=" }, { "version_value" : "1.23.13", "version_affected" : "=" }, { "version_value" : "1.23.14", "version_affected" : "=" }, { "version_value" : "1.23.15", "version_affected" : "=" }, { "version_value" : "1.23.16", "version_affected" : "=" }, { "version_value" : "1.27.0", "version_affected" : "=" }, { "version_value" : "1.27.1", "version_affected" : "=" }, { "version_value" : "1.28.0", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "debian", "product" : { "product_data" : [ { "product_name" : "debian_linux", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-276" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html", "name" : "[mediawiki-announce] 20170406 Security Release: 1.28.1 / 1.27.2 / 1.23.16", "refsource" : "MLIST", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://phabricator.wikimedia.org/T108138", "name" : "https://phabricator.wikimedia.org/T108138", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Third Party Advisory" ] }, { "url" : "https://security-tracker.debian.org/tracker/CVE-2017-0369", "name" : "https://security-tracker.debian.org/tracker/CVE-2017-0369", "refsource" : "CONFIRM", "tags" : [ "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw, allowing a sysops to undelete pages, although the page is protected against it." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.23.0", "versionEndIncluding" : "1.23.16" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.27.0", "versionEndExcluding" : "1.27.2" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.28.0", "versionEndExcluding" : "1.28.1" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "availabilityImpact" : "NONE", "baseScore" : 6.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:S/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "SINGLE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2018-04-13T16:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0370", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "mediawiki", "product" : { "product_data" : [ { "product_name" : "mediawiki", "version" : { "version_data" : [ { "version_value" : "1.23.0", "version_affected" : "=" }, { "version_value" : "1.23.1", "version_affected" : "=" }, { "version_value" : "1.23.2", "version_affected" : "=" }, { "version_value" : "1.23.3", "version_affected" : "=" }, { "version_value" : "1.23.4", "version_affected" : "=" }, { "version_value" : "1.23.5", "version_affected" : "=" }, { "version_value" : "1.23.6", "version_affected" : "=" }, { "version_value" : "1.23.7", "version_affected" : "=" }, { "version_value" : "1.23.8", "version_affected" : "=" }, { "version_value" : "1.23.9", "version_affected" : "=" }, { "version_value" : "1.23.10", "version_affected" : "=" }, { "version_value" : "1.23.11", "version_affected" : "=" }, { "version_value" : "1.23.12", "version_affected" : "=" }, { "version_value" : "1.23.13", "version_affected" : "=" }, { "version_value" : "1.23.14", "version_affected" : "=" }, { "version_value" : "1.23.15", "version_affected" : "=" }, { "version_value" : "1.23.16", "version_affected" : "=" }, { "version_value" : "1.27.0", "version_affected" : "=" }, { "version_value" : "1.27.1", "version_affected" : "=" }, { "version_value" : "1.28.0", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "debian", "product" : { "product_data" : [ { "product_name" : "debian_linux", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html", "name" : "[mediawiki-announce] 20170406 Security Release: 1.28.1 / 1.27.2 / 1.23.16", "refsource" : "MLIST", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://phabricator.wikimedia.org/T48143", "name" : "https://phabricator.wikimedia.org/T48143", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Third Party Advisory" ] }, { "url" : "https://security-tracker.debian.org/tracker/CVE-2017-0370", "name" : "https://security-tracker.debian.org/tracker/CVE-2017-0370", "refsource" : "CONFIRM", "tags" : [ "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw were Spam blacklist is ineffective on encoded URLs inside file inclusion syntax's link parameter." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.23.0", "versionEndIncluding" : "1.23.16" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.27.0", "versionEndExcluding" : "1.27.2" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionStartIncluding" : "1.28.0", "versionEndExcluding" : "1.28.1" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 5.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 3.9, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2018-04-13T16:29Z", "lastModifiedDate" : "2018-05-14T15:41Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0372", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "mediawiki", "product" : { "product_data" : [ { "product_name" : "mediawiki", "version" : { "version_data" : [ { "version_value" : "1.23.15", "version_affected" : "<=" }, { "version_value" : "1.27.0", "version_affected" : "=" }, { "version_value" : "1.27.1", "version_affected" : "=" }, { "version_value" : "1.27.2", "version_affected" : "=" }, { "version_value" : "1.28.0", "version_affected" : "=" }, { "version_value" : "1.28.1", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "debian", "product" : { "product_data" : [ { "product_name" : "debian_linux", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "9.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-74" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://bugs.debian.org/861585", "name" : "https://bugs.debian.org/861585", "refsource" : "MISC", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html", "name" : "[mediawiki-announce] 20170406 Security Release: 1.28.1 / 1.27.2 / 1.23.16", "refsource" : "MLIST", "tags" : [ "Patch", "Release Notes", "Vendor Advisory" ] }, { "url" : "https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000209.html", "name" : "[mediawiki-announce] 20170430 Security release 1.27.3 and 1.28.2", "refsource" : "MLIST", "tags" : [ "Patch", "Release Notes", "Vendor Advisory" ] }, { "url" : "https://phabricator.wikimedia.org/T158689", "name" : "https://phabricator.wikimedia.org/T158689", "refsource" : "CONFIRM", "tags" : [ "Exploit", "Third Party Advisory" ] }, { "url" : "https://security-tracker.debian.org/tracker/CVE-2017-0372", "name" : "https://security-tracker.debian.org/tracker/CVE-2017-0372", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*", "versionEndIncluding" : "1.23.15" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:1.27.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:1.27.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:1.27.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:1.28.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:mediawiki:mediawiki:1.28.1:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 9.8, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 3.9, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 7.5 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.4, "acInsufInfo" : true, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2018-04-13T16:29Z", "lastModifiedDate" : "2018-05-17T15:25Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0373", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "config-model_project", "product" : { "product_data" : [ { "product_name" : "config-model", "version" : { "version_data" : [ { "version_value" : "2.101", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://cpansearch.perl.org/src/DDUMONT/Config-Model-2.102/Changes", "name" : "http://cpansearch.perl.org/src/DDUMONT/Config-Model-2.102/Changes", "refsource" : "CONFIRM", "tags" : [ "Release Notes" ] }, { "url" : "https://anonscm.debian.org/cgit/pkg-perl/packages/libconfig-model-perl.git/commit/?h=stretch&id=e7e5dd1a650939a0e021d1d5b311dbb3c4884773", "name" : "https://anonscm.debian.org/cgit/pkg-perl/packages/libconfig-model-perl.git/commit/?h=stretch&id=e7e5dd1a650939a0e021d1d5b311dbb3c4884773", "refsource" : "CONFIRM", "tags" : [ "Patch" ] }, { "url" : "https://security-tracker.debian.org/tracker/CVE-2017-0373", "name" : "https://security-tracker.debian.org/tracker/CVE-2017-0373", "refsource" : "CONFIRM", "tags" : [ "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The gen_class_pod implementation in lib/Config/Model/Utils/GenClassPod.pm in Config-Model (aka libconfig-model-perl) before 2.102 has a dangerous \"use lib\" line, which allows remote attackers to have an unspecified impact via a crafted Debian package file." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:config-model_project:config-model:*:*:*:*:*:*:*:*", "versionEndIncluding" : "2.101" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.3, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.3, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-23T18:29Z", "lastModifiedDate" : "2017-06-08T12:07Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0374", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "config-model_project", "product" : { "product_data" : [ { "product_name" : "config-model", "version" : { "version_data" : [ { "version_value" : "2.101", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://cpansearch.perl.org/src/DDUMONT/Config-Model-2.102/Changes", "name" : "http://cpansearch.perl.org/src/DDUMONT/Config-Model-2.102/Changes", "refsource" : "CONFIRM", "tags" : [ "Release Notes" ] }, { "url" : "https://anonscm.debian.org/cgit/pkg-perl/packages/libconfig-model-perl.git/commit/?h=stretch&id=0de8471e5a8958ad37446dfcd0362a269e3ec573", "name" : "https://anonscm.debian.org/cgit/pkg-perl/packages/libconfig-model-perl.git/commit/?h=stretch&id=0de8471e5a8958ad37446dfcd0362a269e3ec573", "refsource" : "CONFIRM", "tags" : [ "Patch" ] }, { "url" : "https://security-tracker.debian.org/tracker/CVE-2017-0374", "name" : "https://security-tracker.debian.org/tracker/CVE-2017-0374", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "lib/Config/Model.pm in Config-Model (aka libconfig-model-perl) before 2.102 allows local users to gain privileges via a crafted model in the current working directory, related to use of . with the INC array." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:config-model_project:config-model:*:*:*:*:*:*:*:*", "versionEndIncluding" : "2.101" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 4.6 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.9, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-05-23T18:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0375", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "torproject", "product" : { "product_data" : [ { "product_name" : "tor", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "0.0.2", "version_affected" : "=" }, { "version_value" : "0.0.3", "version_affected" : "=" }, { "version_value" : "0.0.4", "version_affected" : "=" }, { "version_value" : "0.0.5", "version_affected" : "=" }, { "version_value" : "0.0.6", "version_affected" : "=" }, { "version_value" : "0.0.6.1", "version_affected" : "=" }, { "version_value" : "0.0.6.2", "version_affected" : "=" }, { "version_value" : "0.0.7", "version_affected" : "=" }, { "version_value" : "0.0.7.1", "version_affected" : "=" }, { "version_value" : "0.0.7.2", "version_affected" : "=" }, { "version_value" : "0.0.7.3", "version_affected" : "=" }, { "version_value" : "0.0.8", "version_affected" : "=" }, { "version_value" : "0.0.8.1", "version_affected" : "=" }, { "version_value" : "0.0.9", "version_affected" : "=" }, { "version_value" : "0.0.9.1", "version_affected" : "=" }, { "version_value" : "0.0.9.2", "version_affected" : "=" }, { "version_value" : "0.0.9.3", "version_affected" : "=" }, { "version_value" : "0.0.9.4", "version_affected" : "=" }, { "version_value" : "0.0.9.5", "version_affected" : "=" }, { "version_value" : "0.0.9.6", "version_affected" : "=" }, { "version_value" : "0.0.9.7", "version_affected" : "=" }, { "version_value" : "0.0.9.8", "version_affected" : "=" }, { "version_value" : "0.0.9.9", "version_affected" : "=" }, { "version_value" : "0.0.9.10", "version_affected" : "=" }, { "version_value" : "0.1.0.1", "version_affected" : "=" }, { "version_value" : "0.1.0.2", "version_affected" : "=" }, { "version_value" : "0.1.0.4", "version_affected" : "=" }, { "version_value" : "0.1.0.5", "version_affected" : "=" }, { "version_value" : "0.1.0.6", "version_affected" : "=" }, { "version_value" : "0.1.0.7", "version_affected" : "=" }, { "version_value" : "0.1.0.9", "version_affected" : "=" }, { "version_value" : "0.1.0.10", "version_affected" : "=" }, { "version_value" : "0.1.0.11", "version_affected" : "=" }, { "version_value" : "0.1.0.12", "version_affected" : "=" }, { "version_value" : "0.1.0.13", "version_affected" : "=" }, { "version_value" : "0.1.0.14", "version_affected" : "=" }, { "version_value" : "0.1.0.15", "version_affected" : "=" }, { "version_value" : "0.1.0.16", "version_affected" : "=" }, { "version_value" : "0.1.0.17", "version_affected" : "=" }, { "version_value" : "0.1.1.1", "version_affected" : "=" }, { "version_value" : "0.1.1.2", "version_affected" : "=" }, { "version_value" : "0.1.1.4", "version_affected" : "=" }, { "version_value" : "0.1.1.5", "version_affected" : "=" }, { "version_value" : "0.1.1.6", "version_affected" : "=" }, { "version_value" : "0.1.1.7", "version_affected" : "=" }, { "version_value" : "0.1.1.8", "version_affected" : "=" }, { "version_value" : "0.1.1.9", "version_affected" : "=" }, { "version_value" : "0.1.1.10", "version_affected" : "=" }, { "version_value" : "0.1.1.11", "version_affected" : "=" }, { "version_value" : "0.1.1.12", "version_affected" : "=" }, { "version_value" : "0.1.1.13", "version_affected" : "=" }, { "version_value" : "0.1.1.14", "version_affected" : "=" }, { "version_value" : "0.1.1.15", "version_affected" : "=" }, { "version_value" : "0.1.1.16", "version_affected" : "=" }, { "version_value" : "0.1.1.17", "version_affected" : "=" }, { "version_value" : "0.1.1.18", "version_affected" : "=" }, { "version_value" : "0.1.1.19", "version_affected" : "=" }, { "version_value" : "0.1.1.20", "version_affected" : "=" }, { "version_value" : "0.1.1.21", "version_affected" : "=" }, { "version_value" : "0.1.1.22", "version_affected" : "=" }, { "version_value" : "0.1.1.23", "version_affected" : "=" }, { "version_value" : "0.1.1.24", "version_affected" : "=" }, { "version_value" : "0.1.1.25", "version_affected" : "=" }, { "version_value" : "0.1.1.26", "version_affected" : "=" }, { "version_value" : "0.1.2.1", "version_affected" : "=" }, { "version_value" : "0.1.2.2", "version_affected" : "=" }, { "version_value" : "0.1.2.3", "version_affected" : "=" }, { "version_value" : "0.1.2.4", "version_affected" : "=" }, { "version_value" : "0.1.2.5", "version_affected" : "=" }, { "version_value" : "0.1.2.6", "version_affected" : "=" }, { "version_value" : "0.1.2.7", "version_affected" : "=" }, { "version_value" : "0.1.2.8", "version_affected" : "=" }, { "version_value" : "0.1.2.9", "version_affected" : "=" }, { "version_value" : "0.1.2.10", "version_affected" : "=" }, { "version_value" : "0.1.2.11", "version_affected" : "=" }, { "version_value" : "0.1.2.12", "version_affected" : "=" }, { "version_value" : "0.1.2.13", "version_affected" : "=" }, { "version_value" : "0.1.2.14", "version_affected" : "=" }, { "version_value" : "0.1.2.15", "version_affected" : "=" }, { "version_value" : "0.1.2.16", "version_affected" : "=" }, { "version_value" : "0.1.2.17", "version_affected" : "=" }, { "version_value" : "0.1.2.18", "version_affected" : "=" }, { "version_value" : "0.1.2.19", "version_affected" : "=" }, { "version_value" : "0.2.0.1", "version_affected" : "=" }, { "version_value" : "0.2.0.2", "version_affected" : "=" }, { "version_value" : "0.2.0.3", "version_affected" : "=" }, { "version_value" : "0.2.0.4", "version_affected" : "=" }, { "version_value" : "0.2.0.5", "version_affected" : "=" }, { "version_value" : "0.2.0.6", "version_affected" : "=" }, { "version_value" : "0.2.0.7", "version_affected" : "=" }, { "version_value" : "0.2.0.8", "version_affected" : "=" }, { "version_value" : "0.2.0.9", "version_affected" : "=" }, { "version_value" : "0.2.0.10", "version_affected" : "=" }, { "version_value" : "0.2.0.11", "version_affected" : "=" }, { "version_value" : "0.2.0.12", "version_affected" : "=" }, { "version_value" : "0.2.0.13", "version_affected" : "=" }, { "version_value" : "0.2.0.14", "version_affected" : "=" }, { "version_value" : "0.2.0.15", "version_affected" : "=" }, { "version_value" : "0.2.0.16", "version_affected" : "=" }, { "version_value" : "0.2.0.17", "version_affected" : "=" }, { "version_value" : "0.2.0.18", "version_affected" : "=" }, { "version_value" : "0.2.0.19", "version_affected" : "=" }, { "version_value" : "0.2.0.20", "version_affected" : "=" }, { "version_value" : "0.2.0.21", "version_affected" : "=" }, { "version_value" : "0.2.0.22", "version_affected" : "=" }, { "version_value" : "0.2.0.23", "version_affected" : "=" }, { "version_value" : "0.2.0.24", "version_affected" : "=" }, { "version_value" : "0.2.0.25", "version_affected" : "=" }, { "version_value" : "0.2.0.26", "version_affected" : "=" }, { "version_value" : "0.2.0.27", "version_affected" : "=" }, { "version_value" : "0.2.0.28", "version_affected" : "=" }, { "version_value" : "0.2.0.29", "version_affected" : "=" }, { "version_value" : "0.2.0.30", "version_affected" : "=" }, { "version_value" : "0.2.0.31", "version_affected" : "=" }, { "version_value" : "0.2.0.32", "version_affected" : "=" }, { "version_value" : "0.2.0.33", "version_affected" : "=" }, { "version_value" : "0.2.0.34", "version_affected" : "=" }, { "version_value" : "0.2.0.35", "version_affected" : "=" }, { "version_value" : "0.2.1.1", "version_affected" : "=" }, { "version_value" : "0.2.1.2", "version_affected" : "=" }, { "version_value" : "0.2.1.3", "version_affected" : "=" }, { "version_value" : "0.2.1.4", "version_affected" : "=" }, { "version_value" : "0.2.1.5", "version_affected" : "=" }, { "version_value" : "0.2.1.6", "version_affected" : "=" }, { "version_value" : "0.2.1.7", "version_affected" : "=" }, { "version_value" : "0.2.1.8", "version_affected" : "=" }, { "version_value" : "0.2.1.9", "version_affected" : "=" }, { "version_value" : "0.2.1.10", "version_affected" : "=" }, { "version_value" : "0.2.1.11", "version_affected" : "=" }, { "version_value" : "0.2.1.12", "version_affected" : "=" }, { "version_value" : "0.2.1.13", "version_affected" : "=" }, { "version_value" : "0.2.1.14", "version_affected" : "=" }, { "version_value" : "0.2.1.15", "version_affected" : "=" }, { "version_value" : "0.2.1.16", "version_affected" : "=" }, { "version_value" : "0.2.1.17", "version_affected" : "=" }, { "version_value" : "0.2.1.18", "version_affected" : "=" }, { "version_value" : "0.2.1.19", "version_affected" : "=" }, { "version_value" : "0.2.1.20", "version_affected" : "=" }, { "version_value" : "0.2.1.21", "version_affected" : "=" }, { "version_value" : "0.2.1.22", "version_affected" : "=" }, { "version_value" : "0.2.1.23", "version_affected" : "=" }, { "version_value" : "0.2.1.24", "version_affected" : "=" }, { "version_value" : "0.2.1.25", "version_affected" : "=" }, { "version_value" : "0.2.1.26", "version_affected" : "=" }, { "version_value" : "0.2.1.27", "version_affected" : "=" }, { "version_value" : "0.2.1.28", "version_affected" : "=" }, { "version_value" : "0.2.1.29", "version_affected" : "=" }, { "version_value" : "0.2.1.30", "version_affected" : "=" }, { "version_value" : "0.2.1.31", "version_affected" : "=" }, { "version_value" : "0.2.1.32", "version_affected" : "=" }, { "version_value" : "0.2.2.1", "version_affected" : "=" }, { "version_value" : "0.2.2.2", "version_affected" : "=" }, { "version_value" : "0.2.2.3", "version_affected" : "=" }, { "version_value" : "0.2.2.4", "version_affected" : "=" }, { "version_value" : "0.2.2.5", "version_affected" : "=" }, { "version_value" : "0.2.2.6", "version_affected" : "=" }, { "version_value" : "0.2.2.7", "version_affected" : "=" }, { "version_value" : "0.2.2.8", "version_affected" : "=" }, { "version_value" : "0.2.2.9", "version_affected" : "=" }, { "version_value" : "0.2.2.10", "version_affected" : "=" }, { "version_value" : "0.2.2.11", "version_affected" : "=" }, { "version_value" : "0.2.2.12", "version_affected" : "=" }, { "version_value" : "0.2.2.13", "version_affected" : "=" }, { "version_value" : "0.2.2.14", "version_affected" : "=" }, { "version_value" : "0.2.2.15", "version_affected" : "=" }, { "version_value" : "0.2.2.16", "version_affected" : "=" }, { "version_value" : "0.2.2.17", "version_affected" : "=" }, { "version_value" : "0.2.2.18", "version_affected" : "=" }, { "version_value" : "0.2.2.19", "version_affected" : "=" }, { "version_value" : "0.2.2.20", "version_affected" : "=" }, { "version_value" : "0.2.2.21", "version_affected" : "=" }, { "version_value" : "0.2.2.22", "version_affected" : "=" }, { "version_value" : "0.2.2.23", "version_affected" : "=" }, { "version_value" : "0.2.2.24", "version_affected" : "=" }, { "version_value" : "0.2.2.25", "version_affected" : "=" }, { "version_value" : "0.2.2.26", "version_affected" : "=" }, { "version_value" : "0.2.2.27", "version_affected" : "=" }, { "version_value" : "0.2.2.28", "version_affected" : "=" }, { "version_value" : "0.2.2.29", "version_affected" : "=" }, { "version_value" : "0.2.2.30", "version_affected" : "=" }, { "version_value" : "0.2.2.31", "version_affected" : "=" }, { "version_value" : "0.2.2.32", "version_affected" : "=" }, { "version_value" : "0.2.2.33", "version_affected" : "=" }, { "version_value" : "0.2.2.34", "version_affected" : "=" }, { "version_value" : "0.2.2.35", "version_affected" : "=" }, { "version_value" : "0.2.2.36", "version_affected" : "=" }, { "version_value" : "0.2.2.37", "version_affected" : "=" }, { "version_value" : "0.2.2.38", "version_affected" : "=" }, { "version_value" : "0.2.2.39", "version_affected" : "=" }, { "version_value" : "0.2.3", "version_affected" : "=" }, { "version_value" : "0.2.3.1", "version_affected" : "=" }, { "version_value" : "0.2.3.2", "version_affected" : "=" }, { "version_value" : "0.2.3.3", "version_affected" : "=" }, { "version_value" : "0.2.3.4", "version_affected" : "=" }, { "version_value" : "0.2.3.5", "version_affected" : "=" }, { "version_value" : "0.2.3.6", "version_affected" : "=" }, { "version_value" : "0.2.3.7", "version_affected" : "=" }, { "version_value" : "0.2.3.8", "version_affected" : "=" }, { "version_value" : "0.2.3.9", "version_affected" : "=" }, { "version_value" : "0.2.3.10", "version_affected" : "=" }, { "version_value" : "0.2.3.11", "version_affected" : "=" }, { "version_value" : "0.2.3.12", "version_affected" : "=" }, { "version_value" : "0.2.3.13", "version_affected" : "=" }, { "version_value" : "0.2.3.14", "version_affected" : "=" }, { "version_value" : "0.2.3.15", "version_affected" : "=" }, { "version_value" : "0.2.3.16", "version_affected" : "=" }, { "version_value" : "0.2.3.17", "version_affected" : "=" }, { "version_value" : "0.2.3.18", "version_affected" : "=" }, { "version_value" : "0.2.3.19", "version_affected" : "=" }, { "version_value" : "0.2.3.20", "version_affected" : "=" }, { "version_value" : "0.2.3.21", "version_affected" : "=" }, { "version_value" : "0.2.3.22", "version_affected" : "=" }, { "version_value" : "0.2.3.23", "version_affected" : "=" }, { "version_value" : "0.2.3.24", "version_affected" : "=" }, { "version_value" : "0.2.3.25", "version_affected" : "=" }, { "version_value" : "0.2.4.1", "version_affected" : "=" }, { "version_value" : "0.2.4.2", "version_affected" : "=" }, { "version_value" : "0.2.4.3", "version_affected" : "=" }, { "version_value" : "0.2.4.4", "version_affected" : "=" }, { "version_value" : "0.2.4.5", "version_affected" : "=" }, { "version_value" : "0.2.4.6", "version_affected" : "=" }, { "version_value" : "0.2.4.7", "version_affected" : "=" }, { "version_value" : "0.2.4.8", "version_affected" : "=" }, { "version_value" : "0.2.4.9", "version_affected" : "=" }, { "version_value" : "0.2.4.10", "version_affected" : "=" }, { "version_value" : "0.2.4.11", "version_affected" : "=" }, { "version_value" : "0.2.4.12", "version_affected" : "=" }, { "version_value" : "0.2.4.13", "version_affected" : "=" }, { "version_value" : "0.2.4.14", "version_affected" : "=" }, { "version_value" : "0.2.4.15", "version_affected" : "=" }, { "version_value" : "0.2.4.16", "version_affected" : "=" }, { "version_value" : "0.2.4.17", "version_affected" : "=" }, { "version_value" : "0.2.4.18", "version_affected" : "=" }, { "version_value" : "0.2.4.19", "version_affected" : "=" }, { "version_value" : "0.2.4.20", "version_affected" : "=" }, { "version_value" : "0.2.4.21", "version_affected" : "=" }, { "version_value" : "0.2.4.22", "version_affected" : "=" }, { "version_value" : "0.2.4.23", "version_affected" : "=" }, { "version_value" : "0.2.4.24", "version_affected" : "=" }, { "version_value" : "0.2.4.25", "version_affected" : "=" }, { "version_value" : "0.2.4.26", "version_affected" : "=" }, { "version_value" : "0.2.4.27", "version_affected" : "=" }, { "version_value" : "0.2.4.28", "version_affected" : "=" }, { "version_value" : "0.2.4.29", "version_affected" : "=" }, { "version_value" : "0.2.5.1", "version_affected" : "=" }, { "version_value" : "0.2.5.2", "version_affected" : "=" }, { "version_value" : "0.2.5.3", "version_affected" : "=" }, { "version_value" : "0.2.5.4", "version_affected" : "=" }, { "version_value" : "0.2.5.5", "version_affected" : "=" }, { "version_value" : "0.2.5.6", "version_affected" : "=" }, { "version_value" : "0.2.5.7", "version_affected" : "=" }, { "version_value" : "0.2.5.8", "version_affected" : "=" }, { "version_value" : "0.2.5.9", "version_affected" : "=" }, { "version_value" : "0.2.5.10", "version_affected" : "=" }, { "version_value" : "0.2.5.11", "version_affected" : "=" }, { "version_value" : "0.2.5.12", "version_affected" : "=" }, { "version_value" : "0.2.5.13", "version_affected" : "=" }, { "version_value" : "0.2.5.14", "version_affected" : "=" }, { "version_value" : "0.2.6.1", "version_affected" : "=" }, { "version_value" : "0.2.6.2", "version_affected" : "=" }, { "version_value" : "0.2.6.3", "version_affected" : "=" }, { "version_value" : "0.2.6.4", "version_affected" : "=" }, { "version_value" : "0.2.6.5", "version_affected" : "=" }, { "version_value" : "0.2.6.6", "version_affected" : "=" }, { "version_value" : "0.2.6.7", "version_affected" : "=" }, { "version_value" : "0.2.6.8", "version_affected" : "=" }, { "version_value" : "0.2.6.9", "version_affected" : "=" }, { "version_value" : "0.2.6.10", "version_affected" : "=" }, { "version_value" : "0.2.6.11", "version_affected" : "=" }, { "version_value" : "0.2.6.12", "version_affected" : "=" }, { "version_value" : "0.2.7.1", "version_affected" : "=" }, { "version_value" : "0.2.7.2", "version_affected" : "=" }, { "version_value" : "0.2.7.3", "version_affected" : "=" }, { "version_value" : "0.2.7.4", "version_affected" : "=" }, { "version_value" : "0.2.7.5", "version_affected" : "=" }, { "version_value" : "0.2.7.6", "version_affected" : "=" }, { "version_value" : "0.2.7.7", "version_affected" : "=" }, { "version_value" : "0.2.7.8", "version_affected" : "=" }, { "version_value" : "0.2.8.1", "version_affected" : "=" }, { "version_value" : "0.2.8.2", "version_affected" : "=" }, { "version_value" : "0.2.8.3", "version_affected" : "=" }, { "version_value" : "0.2.8.4", "version_affected" : "=" }, { "version_value" : "0.2.8.5", "version_affected" : "=" }, { "version_value" : "0.2.8.6", "version_affected" : "=" }, { "version_value" : "0.2.8.7", "version_affected" : "=" }, { "version_value" : "0.2.8.8", "version_affected" : "=" }, { "version_value" : "0.2.8.9", "version_affected" : "=" }, { "version_value" : "0.2.8.10", "version_affected" : "=" }, { "version_value" : "0.2.8.11", "version_affected" : "=" }, { "version_value" : "0.2.8.12", "version_affected" : "=" }, { "version_value" : "0.2.8.13", "version_affected" : "=" }, { "version_value" : "0.2.8.14", "version_affected" : "=" }, { "version_value" : "0.2.9.0", "version_affected" : "=" }, { "version_value" : "0.2.9.1", "version_affected" : "=" }, { "version_value" : "0.2.9.2", "version_affected" : "=" }, { "version_value" : "0.2.9.3", "version_affected" : "=" }, { "version_value" : "0.2.9.4", "version_affected" : "=" }, { "version_value" : "0.2.9.5", "version_affected" : "=" }, { "version_value" : "0.2.9.6", "version_affected" : "=" }, { "version_value" : "0.2.9.8", "version_affected" : "=" }, { "version_value" : "0.2.9.9", "version_affected" : "=" }, { "version_value" : "0.2.9.10", "version_affected" : "=" }, { "version_value" : "0.2.9.11", "version_affected" : "=" }, { "version_value" : "0.2.9.13", "version_affected" : "=" }, { "version_value" : "0.2.9.14", "version_affected" : "=" }, { "version_value" : "0.2.9.15", "version_affected" : "=" }, { "version_value" : "0.2.9.16", "version_affected" : "=" }, { "version_value" : "0.2.9.17", "version_affected" : "=" }, { "version_value" : "0.3.0.0", "version_affected" : "=" }, { "version_value" : "0.3.0.1", "version_affected" : "=" }, { "version_value" : "0.3.0.2", "version_affected" : "=" }, { "version_value" : "0.3.0.3", "version_affected" : "=" }, { "version_value" : "0.3.0.4", "version_affected" : "=" }, { "version_value" : "0.3.0.5", "version_affected" : "=" }, { "version_value" : "0.3.0.6", "version_affected" : "=" }, { "version_value" : "0.3.0.7", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-617" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99017", "name" : "99017", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://github.com/torproject/tor/commit/79b59a2dfcb68897ee89d98587d09e55f07e68d7", "name" : "https://github.com/torproject/tor/commit/79b59a2dfcb68897ee89d98587d09e55f07e68d7", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Vendor Advisory" ] }, { "url" : "https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html", "name" : "https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html", "refsource" : "CONFIRM", "tags" : [ "Mailing List", "Third Party Advisory" ] }, { "url" : "https://trac.torproject.org/projects/tor/ticket/22493", "name" : "https://trac.torproject.org/projects/tor/ticket/22493", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the relay_send_end_cell_from_edge_ function via a malformed BEGIN cell." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*", "versionEndExcluding" : "0.3.0.8" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "acInsufInfo" : false, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-06-09T17:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0376", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "torproject", "product" : { "product_data" : [ { "product_name" : "tor", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" }, { "version_value" : "0.0.2", "version_affected" : "=" }, { "version_value" : "0.0.3", "version_affected" : "=" }, { "version_value" : "0.0.4", "version_affected" : "=" }, { "version_value" : "0.0.5", "version_affected" : "=" }, { "version_value" : "0.0.6", "version_affected" : "=" }, { "version_value" : "0.0.6.1", "version_affected" : "=" }, { "version_value" : "0.0.6.2", "version_affected" : "=" }, { "version_value" : "0.0.7", "version_affected" : "=" }, { "version_value" : "0.0.7.1", "version_affected" : "=" }, { "version_value" : "0.0.7.2", "version_affected" : "=" }, { "version_value" : "0.0.7.3", "version_affected" : "=" }, { "version_value" : "0.0.8", "version_affected" : "=" }, { "version_value" : "0.0.8.1", "version_affected" : "=" }, { "version_value" : "0.0.9", "version_affected" : "=" }, { "version_value" : "0.0.9.1", "version_affected" : "=" }, { "version_value" : "0.0.9.2", "version_affected" : "=" }, { "version_value" : "0.0.9.3", "version_affected" : "=" }, { "version_value" : "0.0.9.4", "version_affected" : "=" }, { "version_value" : "0.0.9.5", "version_affected" : "=" }, { "version_value" : "0.0.9.6", "version_affected" : "=" }, { "version_value" : "0.0.9.7", "version_affected" : "=" }, { "version_value" : "0.0.9.8", "version_affected" : "=" }, { "version_value" : "0.0.9.9", "version_affected" : "=" }, { "version_value" : "0.0.9.10", "version_affected" : "=" }, { "version_value" : "0.1.0.1", "version_affected" : "=" }, { "version_value" : "0.1.0.2", "version_affected" : "=" }, { "version_value" : "0.1.0.4", "version_affected" : "=" }, { "version_value" : "0.1.0.5", "version_affected" : "=" }, { "version_value" : "0.1.0.6", "version_affected" : "=" }, { "version_value" : "0.1.0.7", "version_affected" : "=" }, { "version_value" : "0.1.0.9", "version_affected" : "=" }, { "version_value" : "0.1.0.10", "version_affected" : "=" }, { "version_value" : "0.1.0.11", "version_affected" : "=" }, { "version_value" : "0.1.0.12", "version_affected" : "=" }, { "version_value" : "0.1.0.13", "version_affected" : "=" }, { "version_value" : "0.1.0.14", "version_affected" : "=" }, { "version_value" : "0.1.0.15", "version_affected" : "=" }, { "version_value" : "0.1.0.16", "version_affected" : "=" }, { "version_value" : "0.1.0.17", "version_affected" : "=" }, { "version_value" : "0.1.1.1", "version_affected" : "=" }, { "version_value" : "0.1.1.2", "version_affected" : "=" }, { "version_value" : "0.1.1.4", "version_affected" : "=" }, { "version_value" : "0.1.1.5", "version_affected" : "=" }, { "version_value" : "0.1.1.6", "version_affected" : "=" }, { "version_value" : "0.1.1.7", "version_affected" : "=" }, { "version_value" : "0.1.1.8", "version_affected" : "=" }, { "version_value" : "0.1.1.9", "version_affected" : "=" }, { "version_value" : "0.1.1.10", "version_affected" : "=" }, { "version_value" : "0.1.1.11", "version_affected" : "=" }, { "version_value" : "0.1.1.12", "version_affected" : "=" }, { "version_value" : "0.1.1.13", "version_affected" : "=" }, { "version_value" : "0.1.1.14", "version_affected" : "=" }, { "version_value" : "0.1.1.15", "version_affected" : "=" }, { "version_value" : "0.1.1.16", "version_affected" : "=" }, { "version_value" : "0.1.1.17", "version_affected" : "=" }, { "version_value" : "0.1.1.18", "version_affected" : "=" }, { "version_value" : "0.1.1.19", "version_affected" : "=" }, { "version_value" : "0.1.1.20", "version_affected" : "=" }, { "version_value" : "0.1.1.21", "version_affected" : "=" }, { "version_value" : "0.1.1.22", "version_affected" : "=" }, { "version_value" : "0.1.1.23", "version_affected" : "=" }, { "version_value" : "0.1.1.24", "version_affected" : "=" }, { "version_value" : "0.1.1.25", "version_affected" : "=" }, { "version_value" : "0.1.1.26", "version_affected" : "=" }, { "version_value" : "0.1.2.1", "version_affected" : "=" }, { "version_value" : "0.1.2.2", "version_affected" : "=" }, { "version_value" : "0.1.2.3", "version_affected" : "=" }, { "version_value" : "0.1.2.4", "version_affected" : "=" }, { "version_value" : "0.1.2.5", "version_affected" : "=" }, { "version_value" : "0.1.2.6", "version_affected" : "=" }, { "version_value" : "0.1.2.7", "version_affected" : "=" }, { "version_value" : "0.1.2.8", "version_affected" : "=" }, { "version_value" : "0.1.2.9", "version_affected" : "=" }, { "version_value" : "0.1.2.10", "version_affected" : "=" }, { "version_value" : "0.1.2.11", "version_affected" : "=" }, { "version_value" : "0.1.2.12", "version_affected" : "=" }, { "version_value" : "0.1.2.13", "version_affected" : "=" }, { "version_value" : "0.1.2.14", "version_affected" : "=" }, { "version_value" : "0.1.2.15", "version_affected" : "=" }, { "version_value" : "0.1.2.16", "version_affected" : "=" }, { "version_value" : "0.1.2.17", "version_affected" : "=" }, { "version_value" : "0.1.2.18", "version_affected" : "=" }, { "version_value" : "0.1.2.19", "version_affected" : "=" }, { "version_value" : "0.2.0.1", "version_affected" : "=" }, { "version_value" : "0.2.0.2", "version_affected" : "=" }, { "version_value" : "0.2.0.3", "version_affected" : "=" }, { "version_value" : "0.2.0.4", "version_affected" : "=" }, { "version_value" : "0.2.0.5", "version_affected" : "=" }, { "version_value" : "0.2.0.6", "version_affected" : "=" }, { "version_value" : "0.2.0.7", "version_affected" : "=" }, { "version_value" : "0.2.0.8", "version_affected" : "=" }, { "version_value" : "0.2.0.9", "version_affected" : "=" }, { "version_value" : "0.2.0.10", "version_affected" : "=" }, { "version_value" : "0.2.0.11", "version_affected" : "=" }, { "version_value" : "0.2.0.12", "version_affected" : "=" }, { "version_value" : "0.2.0.13", "version_affected" : "=" }, { "version_value" : "0.2.0.14", "version_affected" : "=" }, { "version_value" : "0.2.0.15", "version_affected" : "=" }, { "version_value" : "0.2.0.16", "version_affected" : "=" }, { "version_value" : "0.2.0.17", "version_affected" : "=" }, { "version_value" : "0.2.0.18", "version_affected" : "=" }, { "version_value" : "0.2.0.19", "version_affected" : "=" }, { "version_value" : "0.2.0.20", "version_affected" : "=" }, { "version_value" : "0.2.0.21", "version_affected" : "=" }, { "version_value" : "0.2.0.22", "version_affected" : "=" }, { "version_value" : "0.2.0.23", "version_affected" : "=" }, { "version_value" : "0.2.0.24", "version_affected" : "=" }, { "version_value" : "0.2.0.25", "version_affected" : "=" }, { "version_value" : "0.2.0.26", "version_affected" : "=" }, { "version_value" : "0.2.0.27", "version_affected" : "=" }, { "version_value" : "0.2.0.28", "version_affected" : "=" }, { "version_value" : "0.2.0.29", "version_affected" : "=" }, { "version_value" : "0.2.0.30", "version_affected" : "=" }, { "version_value" : "0.2.0.31", "version_affected" : "=" }, { "version_value" : "0.2.0.32", "version_affected" : "=" }, { "version_value" : "0.2.0.33", "version_affected" : "=" }, { "version_value" : "0.2.0.34", "version_affected" : "=" }, { "version_value" : "0.2.0.35", "version_affected" : "=" }, { "version_value" : "0.2.1.1", "version_affected" : "=" }, { "version_value" : "0.2.1.2", "version_affected" : "=" }, { "version_value" : "0.2.1.3", "version_affected" : "=" }, { "version_value" : "0.2.1.4", "version_affected" : "=" }, { "version_value" : "0.2.1.5", "version_affected" : "=" }, { "version_value" : "0.2.1.6", "version_affected" : "=" }, { "version_value" : "0.2.1.7", "version_affected" : "=" }, { "version_value" : "0.2.1.8", "version_affected" : "=" }, { "version_value" : "0.2.1.9", "version_affected" : "=" }, { "version_value" : "0.2.1.10", "version_affected" : "=" }, { "version_value" : "0.2.1.11", "version_affected" : "=" }, { "version_value" : "0.2.1.12", "version_affected" : "=" }, { "version_value" : "0.2.1.13", "version_affected" : "=" }, { "version_value" : "0.2.1.14", "version_affected" : "=" }, { "version_value" : "0.2.1.15", "version_affected" : "=" }, { "version_value" : "0.2.1.16", "version_affected" : "=" }, { "version_value" : "0.2.1.17", "version_affected" : "=" }, { "version_value" : "0.2.1.18", "version_affected" : "=" }, { "version_value" : "0.2.1.19", "version_affected" : "=" }, { "version_value" : "0.2.1.20", "version_affected" : "=" }, { "version_value" : "0.2.1.21", "version_affected" : "=" }, { "version_value" : "0.2.1.22", "version_affected" : "=" }, { "version_value" : "0.2.1.23", "version_affected" : "=" }, { "version_value" : "0.2.1.24", "version_affected" : "=" }, { "version_value" : "0.2.1.25", "version_affected" : "=" }, { "version_value" : "0.2.1.26", "version_affected" : "=" }, { "version_value" : "0.2.1.27", "version_affected" : "=" }, { "version_value" : "0.2.1.28", "version_affected" : "=" }, { "version_value" : "0.2.1.29", "version_affected" : "=" }, { "version_value" : "0.2.1.30", "version_affected" : "=" }, { "version_value" : "0.2.1.31", "version_affected" : "=" }, { "version_value" : "0.2.1.32", "version_affected" : "=" }, { "version_value" : "0.2.2.1", "version_affected" : "=" }, { "version_value" : "0.2.2.2", "version_affected" : "=" }, { "version_value" : "0.2.2.3", "version_affected" : "=" }, { "version_value" : "0.2.2.4", "version_affected" : "=" }, { "version_value" : "0.2.2.5", "version_affected" : "=" }, { "version_value" : "0.2.2.6", "version_affected" : "=" }, { "version_value" : "0.2.2.7", "version_affected" : "=" }, { "version_value" : "0.2.2.8", "version_affected" : "=" }, { "version_value" : "0.2.2.9", "version_affected" : "=" }, { "version_value" : "0.2.2.10", "version_affected" : "=" }, { "version_value" : "0.2.2.11", "version_affected" : "=" }, { "version_value" : "0.2.2.12", "version_affected" : "=" }, { "version_value" : "0.2.2.13", "version_affected" : "=" }, { "version_value" : "0.2.2.14", "version_affected" : "=" }, { "version_value" : "0.2.2.15", "version_affected" : "=" }, { "version_value" : "0.2.2.16", "version_affected" : "=" }, { "version_value" : "0.2.2.17", "version_affected" : "=" }, { "version_value" : "0.2.2.18", "version_affected" : "=" }, { "version_value" : "0.2.2.19", "version_affected" : "=" }, { "version_value" : "0.2.2.20", "version_affected" : "=" }, { "version_value" : "0.2.2.21", "version_affected" : "=" }, { "version_value" : "0.2.2.22", "version_affected" : "=" }, { "version_value" : "0.2.2.23", "version_affected" : "=" }, { "version_value" : "0.2.2.24", "version_affected" : "=" }, { "version_value" : "0.2.2.25", "version_affected" : "=" }, { "version_value" : "0.2.2.26", "version_affected" : "=" }, { "version_value" : "0.2.2.27", "version_affected" : "=" }, { "version_value" : "0.2.2.28", "version_affected" : "=" }, { "version_value" : "0.2.2.29", "version_affected" : "=" }, { "version_value" : "0.2.2.30", "version_affected" : "=" }, { "version_value" : "0.2.2.31", "version_affected" : "=" }, { "version_value" : "0.2.2.32", "version_affected" : "=" }, { "version_value" : "0.2.2.33", "version_affected" : "=" }, { "version_value" : "0.2.2.34", "version_affected" : "=" }, { "version_value" : "0.2.2.35", "version_affected" : "=" }, { "version_value" : "0.2.2.36", "version_affected" : "=" }, { "version_value" : "0.2.2.37", "version_affected" : "=" }, { "version_value" : "0.2.2.38", "version_affected" : "=" }, { "version_value" : "0.2.2.39", "version_affected" : "=" }, { "version_value" : "0.2.3", "version_affected" : "=" }, { "version_value" : "0.2.3.1", "version_affected" : "=" }, { "version_value" : "0.2.3.2", "version_affected" : "=" }, { "version_value" : "0.2.3.3", "version_affected" : "=" }, { "version_value" : "0.2.3.4", "version_affected" : "=" }, { "version_value" : "0.2.3.5", "version_affected" : "=" }, { "version_value" : "0.2.3.6", "version_affected" : "=" }, { "version_value" : "0.2.3.7", "version_affected" : "=" }, { "version_value" : "0.2.3.8", "version_affected" : "=" }, { "version_value" : "0.2.3.9", "version_affected" : "=" }, { "version_value" : "0.2.3.10", "version_affected" : "=" }, { "version_value" : "0.2.3.11", "version_affected" : "=" }, { "version_value" : "0.2.3.12", "version_affected" : "=" }, { "version_value" : "0.2.3.13", "version_affected" : "=" }, { "version_value" : "0.2.3.14", "version_affected" : "=" }, { "version_value" : "0.2.3.15", "version_affected" : "=" }, { "version_value" : "0.2.3.16", "version_affected" : "=" }, { "version_value" : "0.2.3.17", "version_affected" : "=" }, { "version_value" : "0.2.3.18", "version_affected" : "=" }, { "version_value" : "0.2.3.19", "version_affected" : "=" }, { "version_value" : "0.2.3.20", "version_affected" : "=" }, { "version_value" : "0.2.3.21", "version_affected" : "=" }, { "version_value" : "0.2.3.22", "version_affected" : "=" }, { "version_value" : "0.2.3.23", "version_affected" : "=" }, { "version_value" : "0.2.3.24", "version_affected" : "=" }, { "version_value" : "0.2.3.25", "version_affected" : "=" }, { "version_value" : "0.2.4.1", "version_affected" : "=" }, { "version_value" : "0.2.4.2", "version_affected" : "=" }, { "version_value" : "0.2.4.3", "version_affected" : "=" }, { "version_value" : "0.2.4.4", "version_affected" : "=" }, { "version_value" : "0.2.4.5", "version_affected" : "=" }, { "version_value" : "0.2.4.6", "version_affected" : "=" }, { "version_value" : "0.2.4.7", "version_affected" : "=" }, { "version_value" : "0.2.4.8", "version_affected" : "=" }, { "version_value" : "0.2.4.9", "version_affected" : "=" }, { "version_value" : "0.2.4.10", "version_affected" : "=" }, { "version_value" : "0.2.4.11", "version_affected" : "=" }, { "version_value" : "0.2.4.12", "version_affected" : "=" }, { "version_value" : "0.2.4.13", "version_affected" : "=" }, { "version_value" : "0.2.4.14", "version_affected" : "=" }, { "version_value" : "0.2.4.15", "version_affected" : "=" }, { "version_value" : "0.2.4.16", "version_affected" : "=" }, { "version_value" : "0.2.4.17", "version_affected" : "=" }, { "version_value" : "0.2.4.18", "version_affected" : "=" }, { "version_value" : "0.2.4.19", "version_affected" : "=" }, { "version_value" : "0.2.4.20", "version_affected" : "=" }, { "version_value" : "0.2.4.21", "version_affected" : "=" }, { "version_value" : "0.2.4.22", "version_affected" : "=" }, { "version_value" : "0.2.4.23", "version_affected" : "=" }, { "version_value" : "0.2.4.24", "version_affected" : "=" }, { "version_value" : "0.2.4.25", "version_affected" : "=" }, { "version_value" : "0.2.4.26", "version_affected" : "=" }, { "version_value" : "0.2.4.27", "version_affected" : "=" }, { "version_value" : "0.2.4.28", "version_affected" : "=" }, { "version_value" : "0.2.4.29", "version_affected" : "=" }, { "version_value" : "0.2.5.1", "version_affected" : "=" }, { "version_value" : "0.2.5.2", "version_affected" : "=" }, { "version_value" : "0.2.5.3", "version_affected" : "=" }, { "version_value" : "0.2.5.4", "version_affected" : "=" }, { "version_value" : "0.2.5.5", "version_affected" : "=" }, { "version_value" : "0.2.5.6", "version_affected" : "=" }, { "version_value" : "0.2.5.7", "version_affected" : "=" }, { "version_value" : "0.2.5.8", "version_affected" : "=" }, { "version_value" : "0.2.5.9", "version_affected" : "=" }, { "version_value" : "0.2.5.10", "version_affected" : "=" }, { "version_value" : "0.2.5.11", "version_affected" : "=" }, { "version_value" : "0.2.5.12", "version_affected" : "=" }, { "version_value" : "0.2.5.13", "version_affected" : "=" }, { "version_value" : "0.2.5.14", "version_affected" : "=" }, { "version_value" : "0.2.6.1", "version_affected" : "=" }, { "version_value" : "0.2.6.2", "version_affected" : "=" }, { "version_value" : "0.2.6.3", "version_affected" : "=" }, { "version_value" : "0.2.6.4", "version_affected" : "=" }, { "version_value" : "0.2.6.5", "version_affected" : "=" }, { "version_value" : "0.2.6.6", "version_affected" : "=" }, { "version_value" : "0.2.6.7", "version_affected" : "=" }, { "version_value" : "0.2.6.8", "version_affected" : "=" }, { "version_value" : "0.2.6.9", "version_affected" : "=" }, { "version_value" : "0.2.6.10", "version_affected" : "=" }, { "version_value" : "0.2.6.11", "version_affected" : "=" }, { "version_value" : "0.2.6.12", "version_affected" : "=" }, { "version_value" : "0.2.7.1", "version_affected" : "=" }, { "version_value" : "0.2.7.2", "version_affected" : "=" }, { "version_value" : "0.2.7.3", "version_affected" : "=" }, { "version_value" : "0.2.7.4", "version_affected" : "=" }, { "version_value" : "0.2.7.5", "version_affected" : "=" }, { "version_value" : "0.2.7.6", "version_affected" : "=" }, { "version_value" : "0.2.7.7", "version_affected" : "=" }, { "version_value" : "0.2.7.8", "version_affected" : "=" }, { "version_value" : "0.2.8.1", "version_affected" : "=" }, { "version_value" : "0.2.8.2", "version_affected" : "=" }, { "version_value" : "0.2.8.3", "version_affected" : "=" }, { "version_value" : "0.2.8.4", "version_affected" : "=" }, { "version_value" : "0.2.8.5", "version_affected" : "=" }, { "version_value" : "0.2.8.6", "version_affected" : "=" }, { "version_value" : "0.2.8.7", "version_affected" : "=" }, { "version_value" : "0.2.8.8", "version_affected" : "=" }, { "version_value" : "0.2.8.9", "version_affected" : "=" }, { "version_value" : "0.2.8.10", "version_affected" : "=" }, { "version_value" : "0.2.8.11", "version_affected" : "=" }, { "version_value" : "0.2.8.12", "version_affected" : "=" }, { "version_value" : "0.2.8.13", "version_affected" : "=" }, { "version_value" : "0.2.8.14", "version_affected" : "=" }, { "version_value" : "0.2.9.0", "version_affected" : "=" }, { "version_value" : "0.2.9.1", "version_affected" : "=" }, { "version_value" : "0.2.9.2", "version_affected" : "=" }, { "version_value" : "0.2.9.3", "version_affected" : "=" }, { "version_value" : "0.2.9.4", "version_affected" : "=" }, { "version_value" : "0.2.9.5", "version_affected" : "=" }, { "version_value" : "0.2.9.6", "version_affected" : "=" }, { "version_value" : "0.2.9.8", "version_affected" : "=" }, { "version_value" : "0.2.9.9", "version_affected" : "=" }, { "version_value" : "0.2.9.10", "version_affected" : "=" }, { "version_value" : "0.2.9.11", "version_affected" : "=" }, { "version_value" : "0.2.9.13", "version_affected" : "=" }, { "version_value" : "0.2.9.14", "version_affected" : "=" }, { "version_value" : "0.2.9.15", "version_affected" : "=" }, { "version_value" : "0.2.9.16", "version_affected" : "=" }, { "version_value" : "0.2.9.17", "version_affected" : "=" }, { "version_value" : "0.3.0.0", "version_affected" : "=" }, { "version_value" : "0.3.0.1", "version_affected" : "=" }, { "version_value" : "0.3.0.2", "version_affected" : "=" }, { "version_value" : "0.3.0.3", "version_affected" : "=" }, { "version_value" : "0.3.0.4", "version_affected" : "=" }, { "version_value" : "0.3.0.5", "version_affected" : "=" }, { "version_value" : "0.3.0.6", "version_affected" : "=" }, { "version_value" : "0.3.0.7", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "debian", "product" : { "product_data" : [ { "product_name" : "debian_linux", "version" : { "version_data" : [ { "version_value" : "8.0", "version_affected" : "=" }, { "version_value" : "9.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-617" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.debian.org/security/2017/dsa-3877", "name" : "DSA-3877", "refsource" : "DEBIAN", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://github.com/torproject/tor/commit/56a7c5bc15e0447203a491c1ee37de9939ad1dcd", "name" : "https://github.com/torproject/tor/commit/56a7c5bc15e0447203a491c1ee37de9939ad1dcd", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html", "name" : "https://lists.torproject.org/pipermail/tor-announce/2017-June/000131.html", "refsource" : "CONFIRM", "tags" : [ "Mailing List", "Third Party Advisory" ] }, { "url" : "https://trac.torproject.org/projects/tor/ticket/22494", "name" : "https://trac.torproject.org/projects/tor/ticket/22494", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The hidden-service feature in Tor before 0.3.0.8 allows a denial of service (assertion failure and daemon exit) in the connection_edge_process_relay_cell function via a BEGIN_DIR cell on a rendezvous circuit." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*", "versionEndExcluding" : "0.3.0.8" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "acInsufInfo" : false, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-06-09T17:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0377", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "torproject", "product" : { "product_data" : [ { "product_name" : "tor", "version" : { "version_data" : [ { "version_value" : "0.3.0.1", "version_affected" : "=" }, { "version_value" : "0.3.0.2", "version_affected" : "=" }, { "version_value" : "0.3.0.3", "version_affected" : "=" }, { "version_value" : "0.3.0.4", "version_affected" : "=" }, { "version_value" : "0.3.0.5", "version_affected" : "=" }, { "version_value" : "0.3.0.6", "version_affected" : "=" }, { "version_value" : "0.3.0.7", "version_affected" : "=" }, { "version_value" : "0.3.0.8", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://blog.torproject.org/blog/tor-0309-released-security-update-clients", "name" : "https://blog.torproject.org/blog/tor-0309-released-security-update-clients", "refsource" : "CONFIRM", "tags" : [ "Release Notes", "Vendor Advisory" ] }, { "url" : "https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients", "name" : "https://blog.torproject.org/blog/tor-0314-alpha-released-security-update-clients", "refsource" : "CONFIRM", "tags" : [ "Release Notes", "Vendor Advisory" ] }, { "url" : "https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350", "name" : "https://github.com/torproject/tor/commit/665baf5ed5c6186d973c46cdea165c0548027350", "refsource" : "CONFIRM", "tags" : [ "Patch", "Third Party Advisory" ] }, { "url" : "https://security-tracker.debian.org/CVE-2017-0377", "name" : "https://security-tracker.debian.org/CVE-2017-0377", "refsource" : "CONFIRM", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://trac.torproject.org/projects/tor/ticket/22753", "name" : "https://trac.torproject.org/projects/tor/ticket/22753", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay (not the exit relay's family), which might allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.3.0.1:alpha:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.3.0.2:alpha:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.3.0.3:alpha:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.3.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.3.0.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.3.0.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.3.0.7:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.3.0.8:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "acInsufInfo" : true, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-07-02T15:29Z", "lastModifiedDate" : "2017-07-14T14:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0378", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "phamm", "product" : { "product_data" : [ { "product_name" : "phamm", "version" : { "version_data" : [ { "version_value" : "0.6.6", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-79" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.openwall.com/lists/oss-security/2017/07/20/3", "name" : "http://www.openwall.com/lists/oss-security/2017/07/20/3", "refsource" : "CONFIRM", "tags" : [ "Mailing List", "Third Party Advisory" ] }, { "url" : "http://www.phamm.org/docs/CHANGELOG", "name" : "http://www.phamm.org/docs/CHANGELOG", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "http://www.securityfocus.com/bid/99927", "name" : "99927", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://bugs.debian.org/868988", "name" : "https://bugs.debian.org/868988", "refsource" : "CONFIRM", "tags" : [ "Mailing List", "Third Party Advisory" ] }, { "url" : "https://github.com/lota/phamm/issues/21", "name" : "https://github.com/lota/phamm/issues/21", "refsource" : "CONFIRM", "tags" : [ "Exploit", "Issue Tracking", "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "XSS exists in the login_form function in views/helpers.php in Phamm before 0.6.7, exploitable via the PATH_INFO to main.php." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:phamm:phamm:*:*:*:*:*:*:*:*", "versionEndIncluding" : "0.6.6" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "CHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 6.1, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 2.7 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-20T17:29Z", "lastModifiedDate" : "2017-07-26T20:13Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0379", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "gnupg", "product" : { "product_data" : [ { "product_name" : "libgcrypt", "version" : { "version_data" : [ { "version_value" : "1.8.0", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "debian", "product" : { "product_data" : [ { "product_name" : "debian_linux", "version" : { "version_data" : [ { "version_value" : "9.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html", "name" : "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/100503", "name" : "100503", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1041294", "name" : "1041294", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://bugs.debian.org/873383", "name" : "https://bugs.debian.org/873383", "refsource" : "MISC", "tags" : [ "Issue Tracking", "Third Party Advisory" ] }, { "url" : "https://eprint.iacr.org/2017/806", "name" : "https://eprint.iacr.org/2017/806", "refsource" : "MISC", "tags" : [ "Mailing List", "Third Party Advisory" ] }, { "url" : "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=da780c8183cccc8f533c8ace8211ac2cb2bdee7b", "name" : "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=commit;h=da780c8183cccc8f533c8ace8211ac2cb2bdee7b", "refsource" : "MISC", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://lists.debian.org/debian-security-announce/2017/msg00221.html", "name" : "https://lists.debian.org/debian-security-announce/2017/msg00221.html", "refsource" : "MISC", "tags" : [ "Mailing List", "Patch", "Third Party Advisory" ] }, { "url" : "https://security.netapp.com/advisory/ntap-20180726-0002/", "name" : "https://security.netapp.com/advisory/ntap-20180726-0002/", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://security-tracker.debian.org/tracker/CVE-2017-0379", "name" : "https://security-tracker.debian.org/tracker/CVE-2017-0379", "refsource" : "MISC", "tags" : [ "Patch", "Third Party Advisory" ] }, { "url" : "https://www.debian.org/security/2017/dsa-3959", "name" : "DSA-3959", "refsource" : "DEBIAN", "tags" : [ "Patch", "Third Party Advisory" ] }, { "url" : "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html", "name" : "https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html", "refsource" : "CONFIRM", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gnupg:libgcrypt:*:*:*:*:*:*:*:*", "versionEndIncluding" : "1.8.0" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-08-29T22:29Z", "lastModifiedDate" : "2019-01-16T19:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0380", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "torproject", "product" : { "product_data" : [ { "product_name" : "tor", "version" : { "version_data" : [ { "version_value" : "0.2.8.14", "version_affected" : "<=" }, { "version_value" : "0.2.9.0", "version_affected" : "=" }, { "version_value" : "0.2.9.1", "version_affected" : "=" }, { "version_value" : "0.2.9.2", "version_affected" : "=" }, { "version_value" : "0.2.9.3", "version_affected" : "=" }, { "version_value" : "0.2.9.4", "version_affected" : "=" }, { "version_value" : "0.2.9.5", "version_affected" : "=" }, { "version_value" : "0.2.9.6", "version_affected" : "=" }, { "version_value" : "0.2.9.8", "version_affected" : "=" }, { "version_value" : "0.2.9.9", "version_affected" : "=" }, { "version_value" : "0.2.9.10", "version_affected" : "=" }, { "version_value" : "0.2.9.11", "version_affected" : "=" }, { "version_value" : "0.3.0.0", "version_affected" : "=" }, { "version_value" : "0.3.0.1", "version_affected" : "=" }, { "version_value" : "0.3.0.2", "version_affected" : "=" }, { "version_value" : "0.3.0.3", "version_affected" : "=" }, { "version_value" : "0.3.0.4", "version_affected" : "=" }, { "version_value" : "0.3.0.5", "version_affected" : "=" }, { "version_value" : "0.3.0.6", "version_affected" : "=" }, { "version_value" : "0.3.0.7", "version_affected" : "=" }, { "version_value" : "0.3.0.8", "version_affected" : "=" }, { "version_value" : "0.3.0.9", "version_affected" : "=" }, { "version_value" : "0.3.0.10", "version_affected" : "=" }, { "version_value" : "0.3.1.1", "version_affected" : "=" }, { "version_value" : "0.3.1.2", "version_affected" : "=" }, { "version_value" : "0.3.1.3", "version_affected" : "=" }, { "version_value" : "0.3.1.4", "version_affected" : "=" }, { "version_value" : "0.3.1.5", "version_affected" : "=" }, { "version_value" : "0.3.1.6", "version_affected" : "=" }, { "version_value" : "0.3.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-532" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.debian.org/security/2017/dsa-3993", "name" : "DSA-3993", "refsource" : "DEBIAN", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1039519", "name" : "1039519", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://github.com/torproject/tor/commit/09ea89764a4d3a907808ed7d4fe42abfe64bd486", "name" : "https://github.com/torproject/tor/commit/09ea89764a4d3a907808ed7d4fe42abfe64bd486", "refsource" : "CONFIRM", "tags" : [ "Patch", "Third Party Advisory" ] }, { "url" : "https://trac.torproject.org/projects/tor/ticket/23490", "name" : "https://trac.torproject.org/projects/tor/ticket/23490", "refsource" : "CONFIRM", "tags" : [ "Mitigation", "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The rend_service_intro_established function in or/rendservice.c in Tor before 0.2.8.15, 0.2.9.x before 0.2.9.12, 0.3.0.x before 0.3.0.11, 0.3.1.x before 0.3.1.7, and 0.3.2.x before 0.3.2.1-alpha, when SafeLogging is disabled, allows attackers to obtain sensitive information by leveraging access to the log files of a hidden service, because uninitialized stack data is included in an error message about construction of an introduction point circuit." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*", "versionEndIncluding" : "0.2.8.14" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.2.9.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.2.9.0:alpha:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.2.9.1:alpha:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.2.9.2:alpha:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.2.9.3:alpha:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.2.9.4:alpha:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.2.9.5:alpha:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.2.9.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.2.9.8:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.2.9.9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.2.9.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.2.9.11:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.3.0.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.3.0.1:alpha:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.3.0.2:alpha:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.3.0.3:alpha:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.3.0.4:rc:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.3.0.5:rc:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.3.0.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.3.0.7:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.3.0.8:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.3.0.9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.3.0.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.3.1.1:alpha:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.3.1.2:alpha:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.3.1.3:alpha:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.3.1.4:alpha:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.3.1.5:alpha:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.3.1.6:alpha:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:torproject:tor:0.3.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.9, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.2, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-09-18T16:29Z", "lastModifiedDate" : "2017-11-06T02:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0381", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-190" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95248", "name" : "95248", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1039427", "name" : "1039427", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://android.googlesource.com/platform/external/libopus/+/0d052d64480a30e83fcdda80f4774624e044beb7", "name" : "https://android.googlesource.com/platform/external/libopus/+/0d052d64480a30e83fcdda80f4774624e044beb7", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch" ] }, { "url" : "https://security.gentoo.org/glsa/201702-21", "name" : "GLSA-201702-21", "refsource" : "GENTOO", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-01-01.html", "name" : "https://source.android.com/security/bulletin/2017-01-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://support.apple.com/HT208112", "name" : "https://support.apple.com/HT208112", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://support.apple.com/HT208113", "name" : "https://support.apple.com/HT208113", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://support.apple.com/HT208115", "name" : "https://support.apple.com/HT208115", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://support.apple.com/HT208144", "name" : "https://support.apple.com/HT208144", "refsource" : "CONFIRM", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in silk/NLSF_stabilize.c in libopus in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31607432." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-01-12T20:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0382", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95247", "name" : "95247", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-01-01.html", "name" : "https://source.android.com/security/bulletin/2017-01-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Framesequence library could enable an attacker using a specially crafted file to execute arbitrary code in the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses the Framesequence library. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32338390." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-01-12T20:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0383", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-190" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95243", "name" : "95243", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-01-01.html", "name" : "https://source.android.com/security/bulletin/2017-01-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 7.0, 7.1. Android ID: A-31677614." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-01-12T20:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0384", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95239", "name" : "95239", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/frameworks/av/+/321ea5257e37c8edb26e66fe4ee78cca4cd915fe", "name" : "https://android.googlesource.com/platform/frameworks/av/+/321ea5257e37c8edb26e66fe4ee78cca4cd915fe", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch" ] }, { "url" : "https://source.android.com/security/bulletin/2017-01-01.html", "name" : "https://source.android.com/security/bulletin/2017-01-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32095626." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-01-12T20:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0385", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95239", "name" : "95239", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-01-01.html", "name" : "https://source.android.com/security/bulletin/2017-01-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32585400." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-01-12T20:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0386", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95256", "name" : "95256", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-01-01.html", "name" : "https://source.android.com/security/bulletin/2017-01-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the libnl library could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32255299." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-01-12T20:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0387", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95258", "name" : "95258", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-01-01.html", "name" : "https://source.android.com/security/bulletin/2017-01-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in Mediaserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32660278." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-01-12T20:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0388", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95252", "name" : "95252", "refsource" : "BID", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-01-01.html", "name" : "https://source.android.com/security/bulletin/2017-01-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the External Storage Provider could enable a local secondary user to read data from an external storage SD card inserted by the primary user. This issue is rated as High because it is a general bypass for operating system protections that isolate application data from other applications. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32523490." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:P/I:N/A:N", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.1 }, "severity" : "LOW", "exploitabilityScore" : 3.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-01-12T20:59Z", "lastModifiedDate" : "2017-01-18T02:59Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0389", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95251", "name" : "95251", "refsource" : "BID", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-01-01.html", "name" : "https://source.android.com/security/bulletin/2017-01-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in core networking could enable a remote attacker to use specially crafted network packet to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31850211." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.8 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-01-12T20:59Z", "lastModifiedDate" : "2017-01-18T02:59Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0390", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95230", "name" : "95230", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/external/tremolo/+/5dc99237d49e73c27d3eca54f6ccd97d13f94de0", "name" : "https://android.googlesource.com/platform/external/tremolo/+/5dc99237d49e73c27d3eca54f6ccd97d13f94de0", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch" ] }, { "url" : "https://source.android.com/security/bulletin/2017-01-01.html", "name" : "https://source.android.com/security/bulletin/2017-01-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in Tremolo/dpen.s in Mediaserver could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31647370." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-01-12T20:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0391", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95230", "name" : "95230", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038623", "name" : "1038623", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://android.googlesource.com/platform/external/libhevc/+/a33f6725d7e9f92330f995ce2dcf4faa33f6433f", "name" : "https://android.googlesource.com/platform/external/libhevc/+/a33f6725d7e9f92330f995ce2dcf4faa33f6433f", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch" ] }, { "url" : "https://source.android.com/security/bulletin/2017-01-01.html", "name" : "https://source.android.com/security/bulletin/2017-01-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in decoder/ihevcd_decode.c in libhevc in Mediaserver could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32322258." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-01-12T20:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0392", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95230", "name" : "95230", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/frameworks/av/+/453b351ac5bd2b6619925dc966da60adf6b3126c", "name" : "https://android.googlesource.com/platform/frameworks/av/+/453b351ac5bd2b6619925dc966da60adf6b3126c", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch" ] }, { "url" : "https://source.android.com/security/bulletin/2017-01-01.html", "name" : "https://source.android.com/security/bulletin/2017-01-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in VBRISeeker.cpp in libstagefright in Mediaserver could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32577290." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-01-12T20:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0393", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95230", "name" : "95230", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/external/libvpx/+/6886e8e0a9db2dbad723dc37a548233e004b33bc", "name" : "https://android.googlesource.com/platform/external/libvpx/+/6886e8e0a9db2dbad723dc37a548233e004b33bc", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch" ] }, { "url" : "https://source.android.com/security/bulletin/2017-01-01.html", "name" : "https://source.android.com/security/bulletin/2017-01-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in libvpx in Mediaserver could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-30436808." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-01-12T20:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0394", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95255", "name" : "95255", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-01-01.html", "name" : "https://source.android.com/security/bulletin/2017-01-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in Telephony could enable a remote attacker to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31752213." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.8 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-01-12T20:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0395", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95261", "name" : "95261", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-01-01.html", "name" : "https://source.android.com/security/bulletin/2017-01-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in Contacts could enable a local malicious application to silently create contact information. This issue is rated as Moderate because it is a local bypass of user interaction requirements (access to functionality that would normally require either user initiation or user permission). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32219099." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-01-12T20:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0396", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95232", "name" : "95232", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/frameworks/av/+/557bd7bfe6c4895faee09e46fc9b5304a956c8b7", "name" : "https://android.googlesource.com/platform/frameworks/av/+/557bd7bfe6c4895faee09e46fc9b5304a956c8b7", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch" ] }, { "url" : "https://source.android.com/security/bulletin/2017-01-01.html", "name" : "https://source.android.com/security/bulletin/2017-01-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in visualizer/EffectVisualizer.cpp in libeffects in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31781965." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-01-12T20:59Z", "lastModifiedDate" : "2017-01-18T17:24Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0397", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95232", "name" : "95232", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/frameworks/av/+/7a3246b870ddd11861eda2ab458b11d723c7f62c", "name" : "https://android.googlesource.com/platform/frameworks/av/+/7a3246b870ddd11861eda2ab458b11d723c7f62c", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch" ] }, { "url" : "https://source.android.com/security/bulletin/2017-01-01.html", "name" : "https://source.android.com/security/bulletin/2017-01-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in id3/ID3.cpp in libstagefright in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32377688." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-01-12T20:59Z", "lastModifiedDate" : "2017-01-18T16:16Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0398", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95226", "name" : "95226", "refsource" : "BID", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-01-01.html", "name" : "https://source.android.com/security/bulletin/2017-01-01.html", "refsource" : "CONFIRM", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in Audioserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android IDs: A-32438594, A-32635664." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-01-13T16:59Z", "lastModifiedDate" : "2017-01-18T14:58Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0399", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95226", "name" : "95226", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/frameworks/av/+/c66c43ad571ed2590dcd55a762c73c90d9744bac", "name" : "https://android.googlesource.com/platform/frameworks/av/+/c66c43ad571ed2590dcd55a762c73c90d9744bac", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch" ] }, { "url" : "https://source.android.com/security/bulletin/2017-01-01.html", "name" : "https://source.android.com/security/bulletin/2017-01-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in the Qualcomm audio post processor could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32588756." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionStartIncluding" : "4.0", "versionEndIncluding" : "4.4.4" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionStartIncluding" : "5.0", "versionEndIncluding" : "5.0.2" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionStartIncluding" : "5.1", "versionEndIncluding" : "5.1.1" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionStartIncluding" : "6.0", "versionEndIncluding" : "6.0.1" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionStartIncluding" : "7.1.0", "versionEndIncluding" : "7.1.1" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "acInsufInfo" : false, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-01-12T20:59Z", "lastModifiedDate" : "2019-03-12T18:07Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0400", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95226", "name" : "95226", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/frameworks/av/+/c66c43ad571ed2590dcd55a762c73c90d9744bac", "name" : "https://android.googlesource.com/platform/frameworks/av/+/c66c43ad571ed2590dcd55a762c73c90d9744bac", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch" ] }, { "url" : "https://source.android.com/security/bulletin/2017-01-01.html", "name" : "https://source.android.com/security/bulletin/2017-01-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in Audioserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32584034." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "acInsufInfo" : false, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-01-12T20:59Z", "lastModifiedDate" : "2019-05-30T14:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0401", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95226", "name" : "95226", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/frameworks/av/+/321ea5257e37c8edb26e66fe4ee78cca4cd915fe", "name" : "https://android.googlesource.com/platform/frameworks/av/+/321ea5257e37c8edb26e66fe4ee78cca4cd915fe", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch" ] }, { "url" : "https://source.android.com/security/bulletin/2017-01-01.html", "name" : "https://source.android.com/security/bulletin/2017-01-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in the Qualcomm audio post processor could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32588016." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionStartIncluding" : "4.0", "versionEndIncluding" : "4.4.4" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionStartIncluding" : "5.0", "versionEndIncluding" : "5.0.2" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionStartIncluding" : "5.1", "versionEndIncluding" : "5.1.1" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionStartIncluding" : "6.0", "versionEndIncluding" : "6.0.1" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionStartIncluding" : "7.1.0", "versionEndIncluding" : "7.1.1" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "acInsufInfo" : false, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-01-12T20:59Z", "lastModifiedDate" : "2019-03-12T18:07Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0402", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95226", "name" : "95226", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/frameworks/av/+/c66c43ad571ed2590dcd55a762c73c90d9744bac", "name" : "https://android.googlesource.com/platform/frameworks/av/+/c66c43ad571ed2590dcd55a762c73c90d9744bac", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch" ] }, { "url" : "https://android.googlesource.com/platform/hardware/qcom/audio/+/d72ea85c78a1a68bf99fd5804ad9784b4102fe57", "name" : "https://android.googlesource.com/platform/hardware/qcom/audio/+/d72ea85c78a1a68bf99fd5804ad9784b4102fe57", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch" ] }, { "url" : "https://source.android.com/security/bulletin/2017-01-01.html", "name" : "https://source.android.com/security/bulletin/2017-01-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in lvm/wrapper/Bundle/EffectBundle.cpp in libeffects in Audioserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32436341." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionStartIncluding" : "4.0", "versionEndIncluding" : "4.4.4" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionStartIncluding" : "5.0", "versionEndIncluding" : "5.0.2" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionStartIncluding" : "5.1", "versionEndIncluding" : "5.1.1" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionStartIncluding" : "6.0", "versionEndIncluding" : "6.0.1" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionStartIncluding" : "7.1.0", "versionEndIncluding" : "7.1.1" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "acInsufInfo" : false, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-01-12T20:59Z", "lastModifiedDate" : "2019-03-12T13:27Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0403", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95274", "name" : "95274", "refsource" : "BID", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-01-01.html", "name" : "https://source.android.com/security/bulletin/2017-01-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the kernel performance subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32402548." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-01-12T20:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0404", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/95281", "name" : "95281", "refsource" : "BID", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-01-01.html", "name" : "https://source.android.com/security/bulletin/2017-01-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the kernel sound subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32510733." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-01-12T20:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0405", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96048", "name" : "96048", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in Surfaceflinger could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Surfaceflinger process. Product: Android. Versions: 7.0, 7.1.1. Android ID: A-31960359." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2017-07-25T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0406", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96046", "name" : "96046", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. This affects the libhevc library. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32915871." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2017-07-25T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0407", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96046", "name" : "96046", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. This affects the libhevc library. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32873375." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2017-07-25T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0408", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96092", "name" : "96092", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in libgdx could enable an attacker using a specially crafted file to execute arbitrary code in the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 7.1.1. Android ID: A-32769670." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0409", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96091", "name" : "96091", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in libstagefright could enable an attacker using a specially crafted file to execute arbitrary code in the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-31999646." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0410", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-190" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96056", "name" : "96056", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-31929765." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0411", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-367" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96056", "name" : "96056", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41354/", "name" : "41354", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 7.0, 7.1.1. Android ID: A-33042690." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0412", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-367" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96056", "name" : "96056", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41355/", "name" : "41355", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 7.0, 7.1.1. Android ID: A-33039926." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0413", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96063", "name" : "96063", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in AOSP Messaging could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as High because it could be used to gain access to data that the application does not have access to. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32161610." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2017-07-25T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0414", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96063", "name" : "96063", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in AOSP Messaging could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as High because it could be used to gain access to data that the application does not have access to. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32807795." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2017-07-25T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0415", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96089", "name" : "96089", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in Mediaserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32706020." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0416", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-787" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96055", "name" : "96055", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32886609." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0417", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-787" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96055", "name" : "96055", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32705438." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0418", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-787" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96055", "name" : "96055", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32703959." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0419", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96055", "name" : "96055", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32220769." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0420", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96093", "name" : "96093", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in AOSP Mail could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as High because it could be used to gain access to data that the application does not have access to. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32615212." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2017-07-25T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0421", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96096", "name" : "96096", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Framework APIs could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as High because it could be used to gain access to data that the application does not have access to. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32555637." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2017-07-25T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0422", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96097", "name" : "96097", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in Bionic DNS could enable a remote attacker to use a specially crafted network packet to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32322088." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.8 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2017-07-25T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0423", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-732" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96102", "name" : "96102", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in Bluetooth could enable a proximate attacker to manage access to documents on the device. This issue is rated as Moderate because it first requires exploitation of a separate vulnerability in the Bluetooth stack. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32612586." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.6, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.9 }, "severity" : "LOW", "exploitabilityScore" : 5.5, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0424", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96104", "name" : "96104", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in AOSP Messaging could enable a remote attacker using a special crafted file to access data outside of its permission levels. This issue is rated as Moderate because it is a general bypass for a user level defense in depth or exploit mitigation technology in a privileged process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32322450." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2017-07-25T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0425", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96106", "name" : "96106", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in Audioserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32720785." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2017-07-25T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0426", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96099", "name" : "96099", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Filesystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 7.0, 7.1.1. Android ID: A-32799236." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2017-07-25T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0427", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96071", "name" : "96071", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the kernel file system could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-31495866." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0428", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-416" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4561", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4561", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/96070", "name" : "96070", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10. Android ID: A-32401526. References: N-CVE-2017-0428." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0429", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-787" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4561", "name" : "http://nvidia.custhelp.com/app/answers/detail/a_id/4561", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/96070", "name" : "96070", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10. Android ID: A-32636619. References: N-CVE-2017-0429." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0430", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96065", "name" : "96065", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32838767. References: B-RB#107459." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0431", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96068", "name" : "96068", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01", "name" : "https://source.android.com/security/bulletin/2017-02-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-32573899." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2018-04-05T18:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0432", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96067", "name" : "96067", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the MediaTek driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-28332719." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0433", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96061", "name" : "96061", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://alephsecurity.com/vulns/aleph-2016001", "name" : "https://alephsecurity.com/vulns/aleph-2016001", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Synaptics touchscreen driver could enable a local malicious application to execute arbitrary code within the context of the touchscreen chipset. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-31913571." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0434", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96061", "name" : "96061", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Synaptics touchscreen driver could enable a local malicious application to execute arbitrary code within the context of the touchscreen chipset. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-33001936." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0435", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96053", "name" : "96053", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-31906657. References: QC-CR#1078000." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0436", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96053", "name" : "96053", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32624661. References: QC-CR#1078000." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0437", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-120" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96047", "name" : "96047", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32402310. References: QC-CR#1092497." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0438", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-120" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96047", "name" : "96047", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32402604. References: QC-CR#1092497." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0439", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-120" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96047", "name" : "96047", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://www.codeaurora.org/out-bounds-write-wifi-driver-function-hddextscanpasspointfillnetworklist-cve-2017-0439", "name" : "https://www.codeaurora.org/out-bounds-write-wifi-driver-function-hddextscanpasspointfillnetworklist-cve-2017-0439", "refsource" : "CONFIRM", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32450647. References: QC-CR#1092059." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0440", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-120" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96047", "name" : "96047", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-33252788. References: QC-CR#1095770." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0441", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-120" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96047", "name" : "96047", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://www.codeaurora.org/possible-integer-overflow-buffer-overflow-qcanl80211vendorsubcmdextscansetsignificantchange-cve-2017", "name" : "https://www.codeaurora.org/possible-integer-overflow-buffer-overflow-qcanl80211vendorsubcmdextscansetsignificantchange-cve-2017", "refsource" : "CONFIRM", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32872662. References: QC-CR#1095009." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0442", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-120" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96047", "name" : "96047", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32871330. References: QC-CR#1092497." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0443", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96047", "name" : "96047", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.codeaurora.org/out-bounds-write-wlan-driver-function-wlanhddcfg80211setextroamparams-cve-2017-0443", "name" : "https://www.codeaurora.org/out-bounds-write-wlan-driver-function-wlanhddcfg80211setextroamparams-cve-2017-0443", "refsource" : "CONFIRM", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32877494. References: QC-CR#1092497." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0444", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96107", "name" : "96107", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Realtek sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-32705232." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0445", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96054", "name" : "96054", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the HTC touchscreen driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-32769717." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0446", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96054", "name" : "96054", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the HTC touchscreen driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-32917445." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0447", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96054", "name" : "96054", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the HTC touchscreen driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-32919560." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0448", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96105", "name" : "96105", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the NVIDIA video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions: Kernel-3.10. Android ID: A-32721029. References: N-CVE-2017-0448." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2017-07-25T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0449", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96110", "name" : "96110", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Moderate because it first requires compromising a privileged process and is mitigated by current platform configurations. Product: Android. Versions: Kernel-3.10. Android ID: A-31707909. References: B-RB#32094." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0450", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96109", "name" : "96109", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as Moderate because it is mitigated by current platform configurations. Product: Android. Versions: N/A. Android ID: A-32917432." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0451", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96108", "name" : "96108", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1037798", "name" : "1037798", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-02-01.html", "name" : "https://source.android.com/security/bulletin/2017-02-01.html", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Qualcomm sound driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-31796345. References: QC-CR#1073129." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-02-08T15:59Z", "lastModifiedDate" : "2017-07-25T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0452", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96836", "name" : "96836", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Low because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-32873615. References: QC-CR#1093693." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0453", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-787" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96735", "name" : "96735", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=05af1f34723939f477cb7d25adb320d016d68513", "name" : "https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=05af1f34723939f477cb7d25adb320d016d68513", "refsource" : "CONFIRM", "tags" : [ "Patch" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-33979145. References: QC-CR#1105085." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0454", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97399", "name" : "97399", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm audio driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-33353700. References: QC-CR#1104067." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0455", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96812", "name" : "96812", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://source.codeaurora.org/quic/la/kernel/lk/commit/?id=2c00928b4884fdb0b1661bcc530d7e68c9561a2f", "name" : "https://source.codeaurora.org/quic/la/kernel/lk/commit/?id=2c00928b4884fdb0b1661bcc530d7e68c9561a2f", "refsource" : "CONFIRM", "tags" : [ "Patch" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Qualcomm bootloader could help to enable a local malicious application to to execute arbitrary code within the context of the bootloader. This issue is rated as High because it is a general bypass for a bootloader level defense in depth or exploit mitigation technology. Product: Android. Versions: Kernel-3.18. Android ID: A-32370952. References: QC-CR#1082755." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0456", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96947", "name" : "96947", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm IPA driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-33106520. References: QC-CR#1099598." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0457", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96803", "name" : "96803", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm ADSPRPC driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-31695439. References: QC-CR#1086123, QC-CR#1100695." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0458", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96951", "name" : "96951", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=eba46cb98431ba1d7a6bd859f26f6ad03f1bf4d4", "name" : "https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=eba46cb98431ba1d7a6bd859f26f6ad03f1bf4d4", "refsource" : "CONFIRM", "tags" : [ "Patch" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm camera driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-32588962. References: QC-CR#1089433." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0459", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96743", "name" : "96743", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?h=rel/msm-3.18&id=ffacf6e2dc41b6063c3564791ed7a2f903e7e3b7", "name" : "https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?h=rel/msm-3.18&id=ffacf6e2dc41b6063c3564791ed7a2f903e7e3b7", "refsource" : "CONFIRM", "tags" : [ "Patch" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-32644895. References: QC-CR#1091939." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0460", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96948", "name" : "96948", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.codeaurora.org/out-memory-and-out-bounds-vulnerability-while-handling-netlink-messages-cve-2017-0460", "name" : "https://www.codeaurora.org/out-memory-and-out-bounds-vulnerability-while-handling-netlink-messages-cve-2017-0460", "refsource" : "CONFIRM", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm networking driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-31252965. References: QC-CR#1098801." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0461", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96743", "name" : "96743", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=ce5d6f84420a2e6ca6aad6b866992970dd313a65", "name" : "https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=ce5d6f84420a2e6ca6aad6b866992970dd313a65", "refsource" : "CONFIRM", "tags" : [ "Patch" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32073794. References: QC-CR#1100132." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0462", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-362" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm Seemp driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-33353601. References: QC-CR#1102288." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0463", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96948", "name" : "96948", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=955bd7e7ac097bdffbadafab90e5378038fefeb2", "name" : "https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=955bd7e7ac097bdffbadafab90e5378038fefeb2", "refsource" : "CONFIRM", "tags" : [ "Patch" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm networking driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-33277611. References: QC-CR#1101792." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0464", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96735", "name" : "96735", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=051597a4fe19fd1292fb7ea2e627d12d1fd2934f", "name" : "https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=051597a4fe19fd1292fb7ea2e627d12d1fd2934f", "refsource" : "CONFIRM", "tags" : [ "Patch" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32940193. References: QC-CR#1102593." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0465", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-120" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98184", "name" : "98184", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm ADSPRPC driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-34112914. References: QC-CR#1110747." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0466", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96717", "name" : "96717", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33139050." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0467", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96717", "name" : "96717", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33250932." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0468", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96717", "name" : "96717", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33351708." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0469", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96717", "name" : "96717", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33450635." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0470", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96717", "name" : "96717", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33818500." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0471", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96717", "name" : "96717", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33816782." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0472", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96717", "name" : "96717", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33862021." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0473", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96717", "name" : "96717", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33982658." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0474", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96717", "name" : "96717", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 7.0, 7.1.1. Android ID: A-32589224." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0475", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96716", "name" : "96716", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the recovery verifier could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-31914369." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0476", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96756", "name" : "96756", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in AOSP Messaging could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as High due to the possibility of remote code execution within the context of an unprivileged process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33388925." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0477", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96760", "name" : "96760", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in libgdx could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 7.1.1. Android ID: A-33621647." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0478", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96762", "name" : "96762", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://github.com/JiounDai/CVE-2017-0478", "name" : "https://github.com/JiounDai/CVE-2017-0478", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Framesequence library could enable an attacker using a specially crafted file to execute arbitrary code in the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses the Framesequence library. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33718716." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0479", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96958", "name" : "96958", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32707507." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0480", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96958", "name" : "96958", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32705429." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0481", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-120" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96765", "name" : "96765", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/96953", "name" : "96953", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in NFC could enable a proximate attacker to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33434992." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0482", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96733", "name" : "96733", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33090864." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0483", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96733", "name" : "96733", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33137046." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0484", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96733", "name" : "96733", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33298089." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0485", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96733", "name" : "96733", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33387820." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0486", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96733", "name" : "96733", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33621215." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0487", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96733", "name" : "96733", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33751193." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0488", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96733", "name" : "96733", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-34097213." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0489", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96792", "name" : "96792", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in Location Manager could enable a local malicious application to bypass operating system protections for location data. This issue is rated as Moderate because it could be used to generate inaccurate data. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33091107." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0490", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96790", "name" : "96790", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in Wi-Fi could enable a local malicious application to delete user data. This issue is rated as Moderate because it is a local bypass of user interaction requirements that would normally require either user initiation or user permission. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33178389." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0491", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96791", "name" : "96791", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in Package Manager could enable a local malicious application to prevent users from uninstalling applications or removing permissions from applications. This issue is rated as Moderate because it is a local bypass of user interaction requirements. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32553261." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0492", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-1021" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96794", "name" : "96794", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the System UI could enable a local malicious application to create a UI overlay covering the entire screen. This issue is rated as Moderate because it is a local bypass of user interaction requirements that would normally require either user initiation or user permission. Product: Android. Versions: 7.1.1. Android ID: A-30150688." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0493", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-922" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98140", "name" : "98140", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in File-Based Encryption could enable a local malicious attacker to bypass operating system protections for the lock screen. This issue is rated as Moderate due to the possibility of bypassing the lock screen. Product: Android. Versions: 7.0, 7.1.1. Android ID: A-32793550." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0494", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96789", "name" : "96789", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in AOSP Messaging could enable a remote attacker using a special crafted file to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32764144." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0495", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96796", "name" : "96796", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33552073." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0496", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96788", "name" : "96788", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in Setup Wizard could allow a local malicious application to temporarily block access to an affected device. This issue is rated as Moderate because it may require a factory reset to repair the device. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1. Android ID: A-31554152." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0497", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96795", "name" : "96795", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as Moderate because it requires an uncommon device configuration. Product: Android. Versions: 7.0, 7.1.1. Android ID: A-33300701." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 5.4 }, "severity" : "MEDIUM", "exploitabilityScore" : 4.9, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0498", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96793", "name" : "96793", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in Setup Wizard could allow a local attacker to require Google account sign-in after a factory reset. This issue is rated as Moderate because it may require a factory reset to repair the device. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-30352311." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:N/I:N/A:P", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 2.1 }, "severity" : "LOW", "exploitabilityScore" : 3.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0499", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96806", "name" : "96806", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in Audioserver could enable a local malicious application to cause a device hang or reboot. This issue is rated as Low due to the possibility of a temporary denial of service. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32095713." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0500", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96726", "name" : "96726", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in MediaTek components, including the M4U driver, sound driver, touchscreen driver, GPU driver, and Command Queue driver, could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-28429685. References: M-ALPS02710006." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0501", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96726", "name" : "96726", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in MediaTek components, including the M4U driver, sound driver, touchscreen driver, GPU driver, and Command Queue driver, could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-28430015. References: M-ALPS02708983." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0502", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96726", "name" : "96726", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in MediaTek components, including the M4U driver, sound driver, touchscreen driver, GPU driver, and Command Queue driver, could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-28430164. References: M-ALPS02710027." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0503", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96726", "name" : "96726", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in MediaTek components, including the M4U driver, sound driver, touchscreen driver, GPU driver, and Command Queue driver, could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-28449045. References: M-ALPS02710075." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0504", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96726", "name" : "96726", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in MediaTek components, including the M4U driver, sound driver, touchscreen driver, GPU driver, and Command Queue driver, could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-30074628. References: M-ALPS02829371." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0505", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96726", "name" : "96726", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in MediaTek components, including the M4U driver, sound driver, touchscreen driver, GPU driver, and Command Queue driver, could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-31822282. References: M-ALPS02992041." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0506", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96726", "name" : "96726", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in MediaTek components, including the M4U driver, sound driver, touchscreen driver, GPU driver, and Command Queue driver, could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-32276718. References: M-ALPS03006904." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0507", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96952", "name" : "96952", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the kernel ION subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-31992382." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0508", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96952", "name" : "96952", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the kernel ION subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.18. Android ID: A-33940449." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0509", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/94943", "name" : "94943", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/96797", "name" : "96797", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-32124445. References: B-RB#110688." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0510", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96800", "name" : "96800", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://alephsecurity.com/2017/03/08/nexus9-fiq-debugger/", "name" : "https://alephsecurity.com/2017/03/08/nexus9-fiq-debugger/", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the kernel FIQ debugger could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10. Android ID: A-32402555." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0516", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96802", "name" : "96802", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm input hardware driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32341680. References: QC-CR#1096301." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0517", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96799", "name" : "96799", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the MediaTek hardware sensor driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-32372051. References: M-ALPS02973195." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0518", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96950", "name" : "96950", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm fingerprint sensor driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-32370896. References: QC-CR#1086530." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0519", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96950", "name" : "96950", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm fingerprint sensor driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-32372915. References: QC-CR#1086530." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0520", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-120" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96804", "name" : "96804", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=eb2aad752c43f57e88ab9b0c3c5ee7b976ee31dd", "name" : "https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=eb2aad752c43f57e88ab9b0c3c5ee7b976ee31dd", "refsource" : "CONFIRM", "tags" : [ "Patch" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm crypto engine driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-31750232. References: QC-CR#1082636." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0521", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-190" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96951", "name" : "96951", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=dbe4f26f200db10deaf38676b96d8738afcc10c8", "name" : "https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=dbe4f26f200db10deaf38676b96d8738afcc10c8", "refsource" : "CONFIRM", "tags" : [ "Patch" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm camera driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32919951. References: QC-CR#1097709." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0522", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96798", "name" : "96798", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in a MediaTek APK could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High due to the possibility of local arbitrary code execution in a privileged process. Product: Android. Versions: N/A. Android ID: A-32916158. References: M-ALPS03032516." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0523", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96735", "name" : "96735", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=5bb646471da76d3d5cd02cf3da7a03ce6e3cb582", "name" : "https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=5bb646471da76d3d5cd02cf3da7a03ce6e3cb582", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-32835279. References: QC-CR#1096945." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndIncluding" : "3.18" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0524", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96808", "name" : "96808", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Synaptics touchscreen driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-33002026." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0525", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96947", "name" : "96947", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.codeaurora.org/use-after-free-vulnerability-during-ipa-routing-commit-logic-cve-2017-0525", "name" : "https://www.codeaurora.org/use-after-free-vulnerability-during-ipa-routing-commit-logic-cve-2017-0525", "refsource" : "CONFIRM", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm IPA driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-33139056. References: QC-CR#1097714." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0526", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96949", "name" : "96949", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the HTC Sensor Hub Driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-33897738." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0527", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96949", "name" : "96949", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the HTC Sensor Hub Driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-33899318." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0528", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96807", "name" : "96807", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the kernel security subsystem could enable a local malicious application to to execute code in the context of a privileged process. This issue is rated as High because it is a general bypass for a kernel level defense in depth or exploit mitigation technology. Product: Android. Versions: Kernel-3.18. Android ID: A-33351919." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0529", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96810", "name" : "96810", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the MediaTek driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions: N/A. Android ID: A-28449427. References: M-ALPS02710042." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0531", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96743", "name" : "96743", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=530f3a0fd837ed105eddaf99810bc13d97dc4302", "name" : "https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=530f3a0fd837ed105eddaf99810bc13d97dc4302", "refsource" : "CONFIRM", "tags" : [ "Patch" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32877245. References: QC-CR#1087469." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0532", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96834", "name" : "96834", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the MediaTek video codec driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-32370398. References: M-ALPS03069985." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0533", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96734", "name" : "96734", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=e3af5e89426f1c8d4e703d415eff5435b925649f", "name" : "https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=e3af5e89426f1c8d4e703d415eff5435b925649f", "refsource" : "CONFIRM", "tags" : [ "Patch" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Qualcomm video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-32509422. References: QC-CR#1088206." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0534", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96734", "name" : "96734", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=e3af5e89426f1c8d4e703d415eff5435b925649f", "name" : "https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=e3af5e89426f1c8d4e703d415eff5435b925649f", "refsource" : "CONFIRM", "tags" : [ "Patch" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Qualcomm video driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-32508732. References: QC-CR#1088206." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0535", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96833", "name" : "96833", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the HTC sound codec driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-33547247." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0536", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96835", "name" : "96835", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Synaptics touchscreen driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-33555878." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0537", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/96831", "name" : "96831", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1037968", "name" : "1037968", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01", "name" : "https://source.android.com/security/bulletin/2017-03-01", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-03-01.html", "name" : "https://source.android.com/security/bulletin/2017-03-01.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the kernel USB gadget driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-31614969." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-03-08T01:59Z", "lastModifiedDate" : "2017-07-17T13:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0538", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97330", "name" : "97330", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://android.googlesource.com/platform/external/libavc/+/494561291a503840f385fbcd11d9bc5f4dc502b8", "name" : "https://android.googlesource.com/platform/external/libavc/+/494561291a503840f385fbcd11d9bc5f4dc502b8", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33641588." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0539", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97330", "name" : "97330", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://android.googlesource.com/platform/external/libhevc/+/1ab5ce7e42feccd49e49752e6f58f9097ac5d254", "name" : "https://android.googlesource.com/platform/external/libhevc/+/1ab5ce7e42feccd49e49752e6f58f9097ac5d254", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33864300." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0540", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97330", "name" : "97330", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://android.googlesource.com/platform/external/libhevc/+/01ca88bb6c5bdd44e071f8effebe12f1d7da9853", "name" : "https://android.googlesource.com/platform/external/libhevc/+/01ca88bb6c5bdd44e071f8effebe12f1d7da9853", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33966031." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2017-07-13T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0541", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97330", "name" : "97330", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://android.googlesource.com/platform/external/sonivox/+/56d153259cc3e16a6a0014199a2317dde333c978", "name" : "https://android.googlesource.com/platform/external/sonivox/+/56d153259cc3e16a6a0014199a2317dde333c978", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://github.com/JiounDai/CVE-2017-0541", "name" : "https://github.com/JiounDai/CVE-2017-0541", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in sonivox in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-34031018." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0542", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97330", "name" : "97330", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://android.googlesource.com/platform/external/libavc/+/33ef7de9ddc8ea7eb9cbc440d1cf89957a0c267b", "name" : "https://android.googlesource.com/platform/external/libavc/+/33ef7de9ddc8ea7eb9cbc440d1cf89957a0c267b", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33934721." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0543", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97330", "name" : "97330", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://android.googlesource.com/platform/external/libavc/+/f634481e940421020e52f511c1fb34aac1db4b2f", "name" : "https://android.googlesource.com/platform/external/libavc/+/f634481e940421020e52f511c1fb34aac1db4b2f", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-34097866." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0544", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-672" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97337", "name" : "97337", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in CameraBase could enable a local malicious application to execute arbitrary code. This issue is rated as High because it is a local arbitrary code execution in a privileged process. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-31992879." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0545", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-682" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97346", "name" : "97346", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32591350." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0546", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-476" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97341", "name" : "97341", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in SurfaceFlinger could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32628763." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0547", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97338", "name" : "97338", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://android.googlesource.com/platform/frameworks/av/+/9667e3eff2d34c3797c3b529370de47b2c1f1bf6", "name" : "https://android.googlesource.com/platform/frameworks/av/+/9667e3eff2d34c3797c3b529370de47b2c1f1bf6", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in libmedia in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it is a general bypass for operating system protections that isolate application data from other applications. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33861560." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0548", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97398", "name" : "97398", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote denial of service vulnerability in libskia could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 7.0, 7.1.1. Android ID: A-33251605." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0549", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97336", "name" : "97336", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://android.googlesource.com/platform/external/libavc/+/37345554fea84afd446d6d8fbb87feea5a0dde3f", "name" : "https://android.googlesource.com/platform/external/libavc/+/37345554fea84afd446d6d8fbb87feea5a0dde3f", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote denial of service vulnerability in libavc in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33818508." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0550", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97336", "name" : "97336", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://android.googlesource.com/platform/external/libavc/+/7950bf47b6944546a0aff11a7184947de9591b51", "name" : "https://android.googlesource.com/platform/external/libavc/+/7950bf47b6944546a0aff11a7184947de9591b51", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote denial of service vulnerability in libavc in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33933140." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0551", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97336", "name" : "97336", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://android.googlesource.com/platform/external/libavc/+/494561291a503840f385fbcd11d9bc5f4dc502b8", "name" : "https://android.googlesource.com/platform/external/libavc/+/494561291a503840f385fbcd11d9bc5f4dc502b8", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://android.googlesource.com/platform/external/libavc/+/8b5fd8f24eba5dd19ab2f80ea11a9125aa882ae2", "name" : "https://android.googlesource.com/platform/external/libavc/+/8b5fd8f24eba5dd19ab2f80ea11a9125aa882ae2", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote denial of service vulnerability in libavc in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-34097231." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0552", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97336", "name" : "97336", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://android.googlesource.com/platform/external/libavc/+/9a00f562a612d56e7b2b989d168647db900ba6cf", "name" : "https://android.googlesource.com/platform/external/libavc/+/9a00f562a612d56e7b2b989d168647db900ba6cf", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote denial of service vulnerability in libavc in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-34097915." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0553", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-190" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://git.infradead.org/users/tgr/libnl.git/commit/3e18948f17148e6a3c4255bdeaaf01ef6081ceeb", "name" : "http://git.infradead.org/users/tgr/libnl.git/commit/3e18948f17148e6a3c4255bdeaaf01ef6081ceeb", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "http://lists.infradead.org/pipermail/libnl/2017-May/002313.html", "name" : "[libnl] 20170503 ANN: libnl 3.3.0 released", "refsource" : "MLIST", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/97340", "name" : "97340", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "http://www.ubuntu.com/usn/USN-3311-2", "name" : "USN-3311-2", "refsource" : "UBUNTU", "tags" : [ ] }, { "url" : "https://access.redhat.com/errata/RHSA-2017:2299", "name" : "RHSA-2017:2299", "refsource" : "REDHAT", "tags" : [ ] }, { "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6VCF5KS6HOJZLFIY2ZSXSVSDQX65A2PU/", "name" : "FEDORA-2017-7a5363b41d", "refsource" : "FEDORA", "tags" : [ ] }, { "url" : "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KIHASXRQO2YTQPKVP4VGIB2XHPANG6YX/", "name" : "FEDORA-2017-34f6e70fdd", "refsource" : "FEDORA", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://usn.ubuntu.com/usn/usn-3311-1/", "name" : "USN-3311-1", "refsource" : "UBUNTU", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in libnl could enable a local malicious application to execute arbitrary code within the context of the Wi-Fi service. This issue is rated as Moderate because it first requires compromising a privileged process and is mitigated by current platform configurations. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32342065. NOTE: this issue also exists in the upstream libnl before 3.3.0 library." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0554", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-862" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97343", "name" : "97343", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Telephony component could enable a local malicious application to access capabilities outside of its permission levels. This issue is rated as Moderate because it could be used to gain access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33815946." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0555", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97332", "name" : "97332", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://android.googlesource.com/platform/external/libavc/+/0b23c81c3dd9ec38f7e6806a3955fed1925541a0", "name" : "https://android.googlesource.com/platform/external/libavc/+/0b23c81c3dd9ec38f7e6806a3955fed1925541a0", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in libavc in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access data without permission. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33551775." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0556", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97332", "name" : "97332", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://android.googlesource.com/platform/external/libmpeg2/+/f301cff2c1ddd880d9a2c77b22602a137519867b", "name" : "https://android.googlesource.com/platform/external/libmpeg2/+/f301cff2c1ddd880d9a2c77b22602a137519867b", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in libmpeg2 in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access data without permission. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-34093952." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0557", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97332", "name" : "97332", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://android.googlesource.com/platform/external/libmpeg2/+/227c1f829127405e21dab1664393050c652ef71e", "name" : "https://android.googlesource.com/platform/external/libmpeg2/+/227c1f829127405e21dab1664393050c652ef71e", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in libmpeg2 in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access data without permission. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-34093073." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0558", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97332", "name" : "97332", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://android.googlesource.com/platform/frameworks/av/+/50358a80b1724f6cf1bcdf003e1abf9cc141b122", "name" : "https://android.googlesource.com/platform/frameworks/av/+/50358a80b1724f6cf1bcdf003e1abf9cc141b122", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access data without permission. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-34056274." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0559", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97352", "name" : "97352", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in libskia could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access data without permission. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33897722." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0560", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97360", "name" : "97360", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the factory reset process could enable a local malicious attacker to access data from the previous owner. This issue is rated as Moderate due to the possibility of bypassing device protection. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-30681079." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0561", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-787" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97367", "name" : "97367", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://lists.debian.org/debian-lts-announce/2018/11/msg00015.html", "name" : "[debian-lts-announce] 20181113 [SECURITY] [DLA 1573-1] firmware-nonfree security update", "refsource" : "MLIST", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41805/", "name" : "41805", "refsource" : "EXPLOIT-DB", "tags" : [ ] }, { "url" : "https://www.exploit-db.com/exploits/41806/", "name" : "41806", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Broadcom Wi-Fi firmware could enable a remote attacker to execute arbitrary code within the context of the Wi-Fi SoC. This issue is rated as Critical due to the possibility of remote code execution in the context of the Wi-Fi SoC. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-34199105. References: B-RB#110814." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 9.8, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 3.9, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 10.0 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0562", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97345", "name" : "97345", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the MediaTek touchscreen driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-30202425. References: M-ALPS02898189." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0563", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-345" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://seclists.org/fulldisclosure/2017/May/19", "name" : "http://seclists.org/fulldisclosure/2017/May/19", "refsource" : "MISC", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/97342", "name" : "97342", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://alephsecurity.com/vulns/aleph-2017009", "name" : "https://alephsecurity.com/vulns/aleph-2017009", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://github.com/alephsecurity/PoCs/tree/master/CVE-2017-0563", "name" : "https://github.com/alephsecurity/PoCs/tree/master/CVE-2017-0563", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the HTC touchscreen driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10. Android ID: A-32089409." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0564", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97344", "name" : "97344", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-12-01", "name" : "https://source.android.com/security/bulletin/2017-12-01", "refsource" : "CONFIRM", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the kernel ION subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-34276203." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0565", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97349", "name" : "97349", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the MediaTek thermal driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-28175904. References: M-ALPS02696516." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0566", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97351", "name" : "97351", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the MediaTek camera driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-28470975. References: M-ALPS02696367." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0567", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97331", "name" : "97331", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32125310. References: B-RB#112575." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0568", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97331", "name" : "97331", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-34197514. References: B-RB#112600." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0569", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-131" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97331", "name" : "97331", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/41808/", "name" : "41808", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-34198729. References: B-RB#110666." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0570", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97331", "name" : "97331", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-34199963. References: B-RB#110688." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0571", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97331", "name" : "97331", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-34203305. References: B-RB#111541." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0572", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97331", "name" : "97331", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-34198931. References: B-RB#112597." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0573", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97331", "name" : "97331", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-34469904. References: B-RB#91539." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0574", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97331", "name" : "97331", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-34624457. References: B-RB#113189." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0575", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97403", "name" : "97403", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32658595. References: QC-CR#1103099." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0576", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-190" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97395", "name" : "97395", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://github.com/derrekr/android_security/commit/0dd1a733e60cf5239c0a185d4219ba2ef1118a8b", "name" : "https://github.com/derrekr/android_security/commit/0dd1a733e60cf5239c0a185d4219ba2ef1118a8b", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm crypto engine driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-33544431. References: QC-CR#1103089." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0577", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97348", "name" : "97348", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the HTC touchscreen driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-33842951." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0578", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97358", "name" : "97358", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the DTS sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-33964406." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.1" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0579", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97339", "name" : "97339", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm video driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-34125463. References: QC-CR#1115406." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0580", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97335", "name" : "97335", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Synaptics Touchscreen driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-34325986." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0581", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97335", "name" : "97335", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Synaptics Touchscreen driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-34614485." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0582", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97356", "name" : "97356", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the HTC OEM fastboot command could enable a local malicious application to execute arbitrary code within the context of the sensor hub. This issue is rated as Moderate because it first requires exploitation of separate vulnerabilities. Product: Android. Versions: Kernel-3.10. Android ID: A-33178836." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0583", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97368", "name" : "97368", "refsource" : "BID", "tags" : [ ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm CP access driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Moderate because it first requires compromising a privileged process and because of vulnerability specific details which limit the impact of the issue. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32068683. References: QC-CR#1103788." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0584", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97363", "name" : "97363", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32074353. References: QC-CR#1104731." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0585", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97366", "name" : "97366", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32475556. References: B-RB#112953." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0586", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97357", "name" : "97357", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038201", "name" : "1038201", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-04-01", "name" : "https://source.android.com/security/bulletin/2017-04-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Qualcomm sound driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-33649808. References: QC-CR#1097569." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-07T22:59Z", "lastModifiedDate" : "2017-07-11T01:33Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0587", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98119", "name" : "98119", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/external/libmpeg2/+/a86eb798d077b9b25c8f8c77e3c02c2f287c1ce7", "name" : "https://android.googlesource.com/platform/external/libmpeg2/+/a86eb798d077b9b25c8f8c77e3c02c2f287c1ce7", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in libmpeg2 in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35219737." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2017-05-19T18:12Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0588", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98120", "name" : "98120", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/frameworks/av/+/6f1d990ce0f116a205f467d9eb2082795e33872b", "name" : "https://android.googlesource.com/platform/frameworks/av/+/6f1d990ce0f116a205f467d9eb2082795e33872b", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in id3/ID3.cpp in libstagefright in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34618607." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2017-05-19T15:26Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0589", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98122", "name" : "98122", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/external/libhevc/+/bcfc7124f6ef9f1ec128fb2e90de774a5b33d199", "name" : "https://android.googlesource.com/platform/external/libhevc/+/bcfc7124f6ef9f1ec128fb2e90de774a5b33d199", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34897036." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2017-05-19T17:47Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0590", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98123", "name" : "98123", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/external/libhevc/+/45c97f878bee15cd97262fe7f57ecea71990fed7", "name" : "https://android.googlesource.com/platform/external/libhevc/+/45c97f878bee15cd97262fe7f57ecea71990fed7", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35039946." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2017-05-19T18:26Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0591", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98124", "name" : "98124", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/external/libavc/+/5c3fd5d93a268abb20ff22f26009535b40db3c7d", "name" : "https://android.googlesource.com/platform/external/libavc/+/5c3fd5d93a268abb20ff22f26009535b40db3c7d", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34097672." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2017-05-19T17:39Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0592", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98125", "name" : "98125", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/frameworks/av/+/acc192347665943ca674acf117e4f74a88436922", "name" : "https://android.googlesource.com/platform/frameworks/av/+/acc192347665943ca674acf117e4f74a88436922", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in FLACExtractor.cpp in libstagefright in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34970788." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2017-05-19T15:26Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0593", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-732" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98126", "name" : "98126", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to obtain access to custom permissions. This issue is rated as High because it is a general bypass for operating system protections that isolate application data from other applications. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34114230." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0594", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-120" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98128", "name" : "98128", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/frameworks/av/+/594bf934384920618d2b6ce0bcda1f60144cb3eb", "name" : "https://android.googlesource.com/platform/frameworks/av/+/594bf934384920618d2b6ce0bcda1f60144cb3eb", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in codecs/aacenc/SoftAACEncoder2.cpp in libstagefright in Mediaserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34617444." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0595", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98129", "name" : "98129", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/frameworks/av/+/5443b57cc54f2e46b35246637be26a69e9f493e1", "name" : "https://android.googlesource.com/platform/frameworks/av/+/5443b57cc54f2e46b35246637be26a69e9f493e1", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in libstagefright in Mediaserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-34705519." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0596", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98130", "name" : "98130", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/frameworks/av/+/5443b57cc54f2e46b35246637be26a69e9f493e1", "name" : "https://android.googlesource.com/platform/frameworks/av/+/5443b57cc54f2e46b35246637be26a69e9f493e1", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in libstagefright in Mediaserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-34749392." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0597", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-190" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98131", "name" : "98131", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34749571." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0598", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98133", "name" : "98133", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Framework APIs could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as High because it could be used to gain access to data that the application does not have access to. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34128677." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2017-05-19T15:32Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0599", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-252" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98134", "name" : "98134", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/external/libhevc/+/a1424724a00d62ac5efa0e27953eed66850d662f", "name" : "https://android.googlesource.com/platform/external/libhevc/+/a1424724a00d62ac5efa0e27953eed66850d662f", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote denial of service vulnerability in libhevc in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34672748." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0600", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://android.googlesource.com/platform/frameworks/av/+/961e5ac5788b52304e64b9a509781beaf5201fb0", "name" : "https://android.googlesource.com/platform/frameworks/av/+/961e5ac5788b52304e64b9a509781beaf5201fb0", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote denial of service vulnerability in libstagefright in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35269635." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0601", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-732" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98137", "name" : "98137", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An Elevation of Privilege vulnerability in Bluetooth could potentially enable a local malicious application to accept harmful files shared via bluetooth without user permission. This issue is rated as Moderate due to local bypass of user interaction requirements. Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-35258579." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0602", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98141", "name" : "98141", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in Bluetooth could allow a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as Moderate due to details specific to the vulnerability. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34946955." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2017-05-19T16:39Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0603", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-190" }, { "lang" : "en", "value" : "CWE-369" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98143", "name" : "98143", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/frameworks/av/+/36b04932bb93cc3269279282686b439a17a89920", "name" : "https://android.googlesource.com/platform/frameworks/av/+/36b04932bb93cc3269279282686b439a17a89920", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in libstagefright in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as Moderate because it requires an uncommon device configuration. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35763994." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 5.4 }, "severity" : "MEDIUM", "exploitabilityScore" : 4.9, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0604", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-670" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98151", "name" : "98151", "refsource" : "BID", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the kernel Qualcomm power driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-35392981. References: QC-CR#826589." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0605", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ ] } ] }, "references" : { "reference_data" : [ ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ ] }, "impact" : { }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2017-10-04T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0606", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98168", "name" : "98168", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-34088848. References: QC-CR#1116015." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0607", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-704" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98171", "name" : "98171", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-35400551. References: QC-CR#1085928." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0608", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-787" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98172", "name" : "98172", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-35400458. References: QC-CR#1098363." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0609", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98174", "name" : "98174", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-35399801. References: QC-CR#1090482." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0610", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-754" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98255", "name" : "98255", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-35399404. References: QC-CR#1094852." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0611", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-190" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98177", "name" : "98177", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-35393841. References: QC-CR#1084210." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0612", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-770" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98231", "name" : "98231", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm Secure Execution Environment Communicator driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-34389303. References: QC-CR#1061845." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0613", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98186", "name" : "98186", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm Secure Execution Environment Communicator driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-35400457. References: QC-CR#1086140." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0614", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-120" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98187", "name" : "98187", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm Secure Execution Environment Communicator driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-35399405. References: QC-CR#1080290." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0615", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98188", "name" : "98188", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the MediaTek power driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-34259126. References: M-ALPS03150278." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0616", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98189", "name" : "98189", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the MediaTek system management interrupt driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-34470286. References: M-ALPS03149160." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0617", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98190", "name" : "98190", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the MediaTek video driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-34471002. References: M-ALPS03149173." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0618", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98191", "name" : "98191", "refsource" : "BID", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the MediaTek command queue driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-35100728. References: M-ALPS03161536." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0619", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98192", "name" : "98192", "refsource" : "BID", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm pin controller driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-35401152. References: QC-CR#826566." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0620", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-131" }, { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98193", "name" : "98193", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm Secure Channel Manager driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-35401052. References: QC-CR#1081711." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0621", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98196", "name" : "98196", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm camera driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-35399703. References: QC-CR#831322." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0622", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-755" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98198", "name" : "98198", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Goodix touchscreen driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-32749036. References: QC-CR#1098602." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0623", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98199", "name" : "98199", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the HTC bootloader could enable a local malicious application to execute arbitrary code within the context of the bootloader. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-32512358." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0624", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98200", "name" : "98200", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-34327795. References: QC-CR#2005832." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2017-05-19T13:01Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0625", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98201", "name" : "98201", "refsource" : "BID", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the MediaTek command queue driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions: N/A. Android ID: A-35142799. References: M-ALPS03161531." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2017-05-25T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0626", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98202", "name" : "98202", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Qualcomm crypto engine driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-35393124. References: QC-CR#1088050." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2017-05-19T13:10Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0627", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98205", "name" : "98205", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://usn.ubuntu.com/3674-1/", "name" : "USN-3674-1", "refsource" : "UBUNTU", "tags" : [ ] }, { "url" : "https://usn.ubuntu.com/3674-2/", "name" : "USN-3674-2", "refsource" : "UBUNTU", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the kernel UVC driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-33300353." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2018-06-16T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0628", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98211", "name" : "98211", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-34230377. References: QC-CR#1086833." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2017-05-19T13:00Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0629", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98212", "name" : "98212", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-35214296. References: QC-CR#1086833." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2017-05-19T12:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0630", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98213", "name" : "98213", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the kernel trace subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-34277115." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2017-05-19T12:41Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0631", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98216", "name" : "98216", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Qualcomm camera driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-35399756. References: QC-CR#1093232." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2017-05-19T13:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0632", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98221", "name" : "98221", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Qualcomm sound codec driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10. Android ID: A-35392586. References: QC-CR#832915." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2017-05-19T13:07Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0633", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98223", "name" : "98223", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Broadcom Wi-Fi driver could enable a local malicious component to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-36000515. References: B-RB#117131." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2017-05-19T13:04Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0634", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98224", "name" : "98224", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Synaptics touchscreen driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-32511682." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2017-05-19T12:20Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0635", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-476" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://android.googlesource.com/platform/frameworks/av/+/523f6b49c1a2289161f40cf9fe80b92e592e9441", "name" : "https://android.googlesource.com/platform/frameworks/av/+/523f6b49c1a2289161f40cf9fe80b92e592e9441", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-05-01", "name" : "https://source.android.com/security/bulletin/2017-05-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote denial of service vulnerability in HevcUtils.cpp in libstagefright in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as Low due to details specific to the vulnerability. Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-35467107." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-12T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0636", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98866", "name" : "98866", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038623", "name" : "1038623", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-06-01", "name" : "https://source.android.com/security/bulletin/2017-06-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the MediaTek command queue driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-35310230. References: M-ALPS03162263." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-14T13:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0637", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98868", "name" : "98868", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038623", "name" : "1038623", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://android.googlesource.com/platform/external/libhevc/+/ebaa71da6362c497310377df509651974401d258", "name" : "https://android.googlesource.com/platform/external/libhevc/+/ebaa71da6362c497310377df509651974401d258", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Vendor Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-06-01", "name" : "https://source.android.com/security/bulletin/2017-06-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process.Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34064500." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-14T13:29Z", "lastModifiedDate" : "2017-07-08T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0638", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-787" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98872", "name" : "98872", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038623", "name" : "1038623", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-06-01", "name" : "https://source.android.com/security/bulletin/2017-06-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in System UI component could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High because it is a remote arbitrary code execution in an unprivileged process. Product: Android. Versions: 7.1.1, 7.1.2. Android ID: A-36368305." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-14T13:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0639", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98871", "name" : "98871", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038623", "name" : "1038623", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-06-01", "name" : "https://source.android.com/security/bulletin/2017-06-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in Bluetooth component could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it is a general bypass for operating system protections that isolate application data from other applications. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35310991." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-14T13:29Z", "lastModifiedDate" : "2017-07-08T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0640", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98868", "name" : "98868", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038623", "name" : "1038623", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-06-01", "name" : "https://source.android.com/security/bulletin/2017-06-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33129467." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-14T13:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0641", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-665" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98868", "name" : "98868", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038623", "name" : "1038623", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://android.googlesource.com/platform/external/libvpx/+/698796fc930baecf5c3fdebef17e73d5d9a58bcb", "name" : "https://android.googlesource.com/platform/external/libvpx/+/698796fc930baecf5c3fdebef17e73d5d9a58bcb", "refsource" : "CONFIRM", "tags" : [ "Mailing List", "Vendor Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-06-01", "name" : "https://source.android.com/security/bulletin/2017-06-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote denial of service vulnerability in libvpx in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34360591." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-14T13:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0642", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98868", "name" : "98868", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038623", "name" : "1038623", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://android.googlesource.com/platform/external/libhevc/+/913d9e8d93d6b81bb8eac3fc2c1426651f5b259d", "name" : "https://android.googlesource.com/platform/external/libhevc/+/913d9e8d93d6b81bb8eac3fc2c1426651f5b259d", "refsource" : "CONFIRM", "tags" : [ "Mailing List", "Vendor Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-06-01", "name" : "https://source.android.com/security/bulletin/2017-06-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote denial of service vulnerability in libhevc in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34819017." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-14T13:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0643", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98868", "name" : "98868", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038623", "name" : "1038623", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-06-01", "name" : "https://source.android.com/security/bulletin/2017-06-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-35645051." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-14T13:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0644", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98868", "name" : "98868", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038623", "name" : "1038623", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-06-01", "name" : "https://source.android.com/security/bulletin/2017-06-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1. Android ID: A-35472997." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-14T13:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0645", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98871", "name" : "98871", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038623", "name" : "1038623", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-06-01", "name" : "https://source.android.com/security/bulletin/2017-06-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in Bluetooth could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it is a local bypass of user interaction requirements. Product: Android. Versions: 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35385327." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-14T13:29Z", "lastModifiedDate" : "2017-07-08T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0646", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98871", "name" : "98871", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038623", "name" : "1038623", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-06-01", "name" : "https://source.android.com/security/bulletin/2017-06-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in Bluetooth component could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate due to details specific to the vulnerability. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-33899337." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-14T13:29Z", "lastModifiedDate" : "2017-07-08T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0647", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98877", "name" : "98877", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038623", "name" : "1038623", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-06-01", "name" : "https://source.android.com/security/bulletin/2017-06-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in libziparchive could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36392138." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-14T13:29Z", "lastModifiedDate" : "2017-07-08T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0648", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98875", "name" : "98875", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038623", "name" : "1038623", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-06-01", "name" : "https://source.android.com/security/bulletin/2017-06-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the kernel FIQ debugger could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10. Android ID: A-36101220." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-14T13:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0649", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98866", "name" : "98866", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038623", "name" : "1038623", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-06-01", "name" : "https://source.android.com/security/bulletin/2017-06-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the MediaTek sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Moderate because it first requires compromising a privileged process and because of vulnerability specific details which limit the impact of the issue. Product: Android. Versions: N/A. Android ID: A-34468195. References: M-ALPS03162283." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.0, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.0, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.6 }, "severity" : "HIGH", "exploitabilityScore" : 4.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-14T13:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0650", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.10", "version_affected" : "=" }, { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securitytracker.com/id/1038623", "name" : "1038623", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-06-01", "name" : "https://source.android.com/security/bulletin/2017-06-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Synaptics touchscreen driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Low because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-35472278." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-14T13:29Z", "lastModifiedDate" : "2017-07-08T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0651", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "linux", "product" : { "product_data" : [ { "product_name" : "linux_kernel", "version" : { "version_data" : [ { "version_value" : "3.18", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/98875", "name" : "98875", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038623", "name" : "1038623", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-06-01", "name" : "https://source.android.com/security/bulletin/2017-06-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the kernel ION subsystem could enable a local malicious application to access data outside of its permission levels. This issue is rated as Low because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.18. Android ID: A-35644815." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:linux:linux_kernel:3.18:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:H/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "HIGH", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 2.6 }, "severity" : "LOW", "exploitabilityScore" : 4.9, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-14T13:29Z", "lastModifiedDate" : "2017-07-08T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0663", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-787" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.debian.org/security/2017/dsa-3952", "name" : "DSA-3952", "refsource" : "DEBIAN", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/98877", "name" : "98877", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1038623", "name" : "1038623", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://security.gentoo.org/glsa/201711-01", "name" : "GLSA-201711-01", "refsource" : "GENTOO", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-06-01", "name" : "https://source.android.com/security/bulletin/2017-06-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-06-14T13:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0664", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99470", "name" : "99470", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Android framework. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36491278." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0665", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99470", "name" : "99470", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Android framework. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36991414." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0666", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-682" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99470", "name" : "99470", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Android framework. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37285689." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0667", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99470", "name" : "99470", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Android framework. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37478824." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0668", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99470", "name" : "99470", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A information disclosure vulnerability in the Android framework. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-22011579." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2017-07-11T13:55Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0669", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99470", "name" : "99470", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A information disclosure vulnerability in the Android framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34114752." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2017-07-11T13:55Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0670", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99470", "name" : "99470", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android framework. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36104177." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0671", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.4.4", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android libraries. Product: Android. Versions: 4.4.4. Android ID: A-34514762." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0672", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android libraries. Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-34778578." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0673", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99478", "name" : "99478", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-33974623." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0674", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99478", "name" : "99478", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34231163." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0675", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99478", "name" : "99478", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34779227." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0676", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99478", "name" : "99478", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34896431." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0677", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99478", "name" : "99478", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36035074." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0678", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99478", "name" : "99478", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-36576151." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0679", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-682" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99478", "name" : "99478", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36996978." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0680", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99478", "name" : "99478", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37008096." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0681", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99478", "name" : "99478", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37208566." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0682", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99478", "name" : "99478", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-36588422." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0683", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99478", "name" : "99478", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-36591008." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0684", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-787" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99478", "name" : "99478", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35421151." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0685", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-835" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99478", "name" : "99478", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34203195." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0686", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-476" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99478", "name" : "99478", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34231231." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0687", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99478", "name" : "99478", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35583675." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-18T17:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0688", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99478", "name" : "99478", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35584425." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0689", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" }, { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99478", "name" : "99478", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36215950." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0690", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-400" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99478", "name" : "99478", "refsource" : "BID", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36592202." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0691", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-190" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99478", "name" : "99478", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework. Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-36724453." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0692", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-674" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99478", "name" : "99478", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36725407." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0693", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99478", "name" : "99478", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36993291." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0694", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99478", "name" : "99478", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37093318." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0695", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-787" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99478", "name" : "99478", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37094889." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0696", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99478", "name" : "99478", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37207120." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0697", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-772" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99478", "name" : "99478", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37239013." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0698", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99478", "name" : "99478", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A information disclosure vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35467458." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2017-07-11T13:55Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0699", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99478", "name" : "99478", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A information disclosure vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36490809." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2017-07-11T13:55Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0700", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99472", "name" : "99472", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android system ui. Product: Android. Versions: 7.1.1, 7.1.2. Android ID: A-35639138." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0701", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-787" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99472", "name" : "99472", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android system ui. Product: Android. Versions: 7.1.1, 7.1.2. Android ID: A-36385715." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0702", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-190" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99472", "name" : "99472", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android system ui. Product: Android. Versions: 7.1.1, 7.1.2. Android ID: A-36621442." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0703", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-732" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99472", "name" : "99472", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Android system ui. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-33123882." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0704", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99472", "name" : "99472", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Android system ui. Product: Android. Versions: 7.1.1, 7.1.2. Android ID: A-33059280." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0705", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99482", "name" : "99482", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://github.com/ScottyBauer/Android_Kernel_CVE_POCs/blob/master/CVE-2017-0705.c", "name" : "https://github.com/ScottyBauer/Android_Kernel_CVE_POCs/blob/master/CVE-2017-0705.c", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-34973477. References: B-RB#119898." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "PHYSICAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 6.8, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 0.9, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0706", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99482", "name" : "99482", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-35195787. References: B-RB#120532." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "PHYSICAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 6.8, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 0.9, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0707", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99474", "name" : "99474", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the HTC led driver. Product: Android. Versions: Android kernel. Android ID: A-36088467." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0708", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99474", "name" : "99474", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A information disclosure vulnerability in the HTC sound driver. Product: Android. Versions: Android kernel. Android ID: A-35384879." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2017-07-11T15:24Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0709", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99474", "name" : "99474", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A information disclosure vulnerability in the HTC sensor hub driver. Product: Android. Versions: Android kernel. Android ID: A-35468048." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 3.3, "baseSeverity" : "LOW" }, "exploitabilityScore" : 1.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2017-07-11T15:23Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0710", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99468", "name" : "99468", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Upstream Linux tcb. Product: Android. Versions: Android kernel. Android ID: A-34951864." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0711", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99466", "name" : "99466", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-07-01", "name" : "https://source.android.com/security/bulletin/2017-07-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the MediaTek networking driver. Product: Android. Versions: Android kernel. Android ID: A-36099953. References: M-ALPS03206781." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-07-06T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0712", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" }, { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100220", "name" : "100220", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Android framework (wi-fi service). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37207928." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0713", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100219", "name" : "100219", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android libraries (sfntly). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-32096780." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0714", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100204", "name" : "100204", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (h263 decoder). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36492637." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0715", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-131" }, { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100204", "name" : "100204", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36998372." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0716", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-129" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100204", "name" : "100204", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37203196." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0718", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100204", "name" : "100204", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (mpeg2 decoder). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37273547." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0719", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-772" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100204", "name" : "100204", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (mpeg2 decoder). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37273673." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0720", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-252" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100204", "name" : "100204", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37430213." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0721", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100204", "name" : "100204", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37561455." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0722", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100204", "name" : "100204", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (h263 decoder). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37660827." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0723", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-665" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100204", "name" : "100204", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37968755." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0724", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100204", "name" : "100204", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36819262." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0725", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-125" }, { "lang" : "en", "value" : "CWE-770" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100204", "name" : "100204", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework (libskia). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-37627194." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0726", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-772" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100204", "name" : "100204", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36389123." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0727", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-362" }, { "lang" : "en", "value" : "CWE-416" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100204", "name" : "100204", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Android media framework (libgui). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-33004354." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0728", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100204", "name" : "100204", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework (hevc decoder). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37469795." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0729", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-190" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100204", "name" : "100204", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Android media framework (mediadrmserver). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37710346." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0730", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-909" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100204", "name" : "100204", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework (h264 decoder). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36279112." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0731", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-763" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100204", "name" : "100204", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Android media framework (mpeg4 encoder). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36075363." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0732", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100204", "name" : "100204", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37504237." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0733", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-404" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100204", "name" : "100204", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework (libmediaplayerservice). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-38391487." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0734", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100204", "name" : "100204", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-38014992." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0735", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-665" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100204", "name" : "100204", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-38239864." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0736", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100204", "name" : "100204", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-38487564." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0737", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-129" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100204", "name" : "100204", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://usn.ubuntu.com/3692-2/", "name" : "USN-3692-2", "refsource" : "UBUNTU", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37563942." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0738", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100204", "name" : "100204", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A information disclosure vulnerability in the Android media framework (audioserver). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37563371." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0739", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100204", "name" : "100204", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A information disclosure vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37712181." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2017-08-15T14:27Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0740", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100217", "name" : "100217", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Broadcom networking driver. Product: Android. Versions: Android kernel. Android ID: A-37168488. References: B-RB#116402." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0741", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100209", "name" : "100209", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the MediaTek gpu driver. Product: Android. Versions: Android kernel. Android ID: A-32458601. References: M-ALPS03007523." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0742", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100209", "name" : "100209", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the MediaTek video driver. Product: Android. Versions: Android kernel. Android ID: A-36074857. References: M-ALPS03275524." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0744", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100210", "name" : "100210", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the NVIDIA firmware processing code. Product: Android. Versions: Android kernel. Android ID: A-34112726. References: N-CVE-2017-0744." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "LOW", "baseScore" : 5.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 4.6 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.9, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2018-04-05T18:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0745", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-665" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100204", "name" : "100204", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (avc decoder). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37079296." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0746", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100213", "name" : "100213", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Qualcomm ipa driver. Product: Android. Versions: Android kernel. Android ID: A-35467471. References: QC-CR#2029392." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0747", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100213", "name" : "100213", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Qualcomm proprietary component. Product: Android. Versions: Android kernel. Android ID: A-32524214. References: QC-CR#2044821." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0748", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100210", "name" : "100210", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Qualcomm audio driver. Product: Android. Versions: Android Kernel. Android ID: A-35764875. References: QC-CR#2029798." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 3.9, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2018-04-05T18:29Z", "lastModifiedDate" : "2018-04-17T18:46Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0749", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100215", "name" : "100215", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://bugzilla.novell.com/show_bug.cgi?id=1053162", "name" : "https://bugzilla.novell.com/show_bug.cgi?id=1053162", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-0749.html", "name" : "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-0749.html", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://security-tracker.debian.org/tracker/CVE-2017-0749", "name" : "https://security-tracker.debian.org/tracker/CVE-2017-0749", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Upstream Linux linux kernel. Product: Android. Versions: Android kernel. Android ID: A-36007735." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0750", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-787" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100215", "name" : "100215", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://bugzilla.novell.com/show_bug.cgi?id=1053160", "name" : "https://bugzilla.novell.com/show_bug.cgi?id=1053160", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-0750.html", "name" : "https://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-0750.html", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://security-tracker.debian.org/tracker/CVE-2017-0750", "name" : "https://security-tracker.debian.org/tracker/CVE-2017-0750", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://usn.ubuntu.com/3583-1/", "name" : "USN-3583-1", "refsource" : "UBUNTU", "tags" : [ ] }, { "url" : "https://usn.ubuntu.com/3583-2/", "name" : "USN-3583-2", "refsource" : "UBUNTU", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Upstream Linux file system. Product: Android. Versions: Android kernel. Android ID: A-36817013." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-09T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0751", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100210", "name" : "100210", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Qualcomm QCE driver. Product: Android. Versions: Android kernel. Android ID: A-36591162. References: QC-CR#2045061." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "LOW", "baseScore" : 5.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 4.6 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.9, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2018-04-05T18:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0752", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-732" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100673", "name" : "100673", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Android framework (windowmanager). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-62196835." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0753", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100650", "name" : "100650", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android libraries (libgdx). Product: Android. Versions: 7.1.1, 7.1.2, 8.0. Android ID: A-62218744." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0755", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100650", "name" : "100650", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Android libraries (libminikin). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-32178311." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0756", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-367" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100649", "name" : "100649", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34621073." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0757", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100649", "name" : "100649", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36006815." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0758", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100649", "name" : "100649", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36492741." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0759", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-755" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100649", "name" : "100649", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36715268." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0760", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-755" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100649", "name" : "100649", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37237396." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0761", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100649", "name" : "100649", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-38448381." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0762", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-755" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100649", "name" : "100649", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-62214264." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0763", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100649", "name" : "100649", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62534693." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0764", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100649", "name" : "100649", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libvorbis). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62872015." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0765", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100649", "name" : "100649", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62872863." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0766", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100649", "name" : "100649", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libjhead). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37776688." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0767", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-120" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100649", "name" : "100649", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Android media framework (libeffects). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37536407." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0768", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100649", "name" : "100649", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Android media framework (libeffects). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62019992." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0769", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-404" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100649", "name" : "100649", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-37662122." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0770", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100649", "name" : "100649", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Android media framework (libmediaplayerservice). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-38234812." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0771", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-770" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100649", "name" : "100649", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework (libskia). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-37624243." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0772", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100649", "name" : "100649", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-38115076." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0773", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100649", "name" : "100649", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-37615911." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0774", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-252" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100649", "name" : "100649", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-62673844." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0775", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-834" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100649", "name" : "100649", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62673179." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0776", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100649", "name" : "100649", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-38496660." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2017-09-15T12:55Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0777", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100649", "name" : "100649", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-38342499." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2017-09-15T12:54Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0778", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100649", "name" : "100649", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-62133227." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 7.1, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.2 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.8 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 7.8, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0779", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100649", "name" : "100649", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A information disclosure vulnerability in the Android media framework (audioflinger). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-38340117." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2017-09-15T16:30Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0780", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100674", "name" : "100674", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android runtime (android messenger). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-37742976." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0781", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html", "name" : "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/100810", "name" : "100810", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/44415/", "name" : "44415", "refsource" : "EXPLOIT-DB", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63146105." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 8.3 }, "severity" : "HIGH", "exploitabilityScore" : 6.5, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-09-14T19:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0782", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-120" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html", "name" : "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/100822", "name" : "100822", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63146237." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 8.3 }, "severity" : "HIGH", "exploitabilityScore" : 6.5, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-09-14T19:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0783", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html", "name" : "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/100811", "name" : "100811", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63145701." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 6.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:L/Au:N/C:C/I:N/A:N", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 6.1 }, "severity" : "MEDIUM", "exploitabilityScore" : 6.5, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-09-14T19:29Z", "lastModifiedDate" : "2018-01-18T18:18Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0784", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-732" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100671", "name" : "100671", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Android system (nfc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37287958." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 5.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 6.5, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0785", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html", "name" : "http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html", "name" : "http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/100812", "name" : "100812", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1041300", "name" : "1041300", "refsource" : "SECTRACK", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63146698." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 6.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:L/Au:N/C:P/I:N/A:N", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 3.3 }, "severity" : "LOW", "exploitabilityScore" : 6.5, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-09-14T19:29Z", "lastModifiedDate" : "2018-07-28T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0786", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100655", "name" : "100655", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37351060. References: B-V2017060101." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 5.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 6.5, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0787", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100655", "name" : "100655", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37722970. References: B-V2017053104." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 5.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 6.5, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0788", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100655", "name" : "100655", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37722328. References: B-V2017053103." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 5.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 6.5, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0789", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100655", "name" : "100655", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37685267. References: B-V2017053102." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 5.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 6.5, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0790", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100655", "name" : "100655", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37357704. References: B-V2017053101." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 5.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 6.5, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0791", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100655", "name" : "100655", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37306719. References: B-V2017052302." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 5.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 6.5, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0792", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100655", "name" : "100655", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A information disclosure vulnerability in the Broadcom wi-fi driver. Product: Android. Versions: Android kernel. Android ID: A-37305578. References: B-V2017052301." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "ADJACENT_NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 6.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:A/AC:L/Au:N/C:P/I:N/A:N", "accessVector" : "ADJACENT_NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 3.3 }, "severity" : "LOW", "exploitabilityScore" : 6.5, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2017-09-12T22:20Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0793", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "8.0", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100670", "name" : "100670", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A information disclosure vulnerability in the N/A memory subsystem. Product: Android. Versions: Android kernel. Android ID: A-35764946." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "8.0" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2017-09-15T18:20Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0794", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "8.0", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-362" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100667", "name" : "100667", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://usn.ubuntu.com/3798-1/", "name" : "USN-3798-1", "refsource" : "UBUNTU", "tags" : [ ] }, { "url" : "https://usn.ubuntu.com/3798-2/", "name" : "USN-3798-2", "refsource" : "UBUNTU", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Upstream kernel scsi driver. Product: Android. Versions: Android kernel. Android ID: A-35644812." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "8.0" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0795", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100652", "name" : "100652", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the MediaTek accessory detector driver. Product: Android. Versions: Android kernel. Android ID: A-36198473. References: M-ALPS03361480." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0796", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100652", "name" : "100652", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the MediaTek auxadc driver. Product: Android. Versions: Android kernel. Android ID: A-62458865. References: M-ALPS03353884, M-ALPS03353886, M-ALPS03353887." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0797", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100652", "name" : "100652", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the MediaTek accessory detector driver. Product: Android. Versions: Android kernel. Android ID: A-62459766. References: M-ALPS03353854." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0798", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100652", "name" : "100652", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the MediaTek kernel. Product: Android. Versions: Android kernel. Android ID: A-36100671. References: M-ALPS03365532." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0799", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100652", "name" : "100652", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the MediaTek lastbus. Product: Android. Versions: Android kernel. Android ID: A-36731602. References: M-ALPS03342072." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0800", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100652", "name" : "100652", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the MediaTek teei. Product: Android. Versions: Android kernel. Android ID: A-37683975. References: M-ALPS03302988." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0801", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100652", "name" : "100652", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the MediaTek libmtkomxvdec. Product: Android. Versions: Android kernel. Android ID: A-38447970. References: M-ALPS03337980." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0802", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100652", "name" : "100652", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the MediaTek kernel. Product: Android. Versions: Android kernel. Android ID: A-36232120. References: M-ALPS03384818." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0803", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100652", "name" : "100652", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the MediaTek accessory detector driver. Product: Android. Versions: Android kernel. Android ID: A-36136137. References: M-ALPS03361477." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0804", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.1.2", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100652", "name" : "100652", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-09-01", "name" : "https://source.android.com/security/bulletin/2017-09-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the MediaTek mmc driver. Product: Android. Versions: Android kernel. Android ID: A-36274676. References: M-ALPS03361487." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "7.1.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-09-08T20:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0805", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-129" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/2017-08-01", "name" : "https://source.android.com/security/bulletin/2017-08-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A elevation of privilege vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37237701." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-08-24T00:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0806", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-502" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101086", "name" : "101086", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/frameworks/base/+/b87c968e5a41a1a09166199bf54eee12608f3900", "name" : "https://android.googlesource.com/platform/frameworks/base/+/b87c968e5a41a1a09166199bf54eee12608f3900", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Vendor Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-10-01", "name" : "https://source.android.com/security/bulletin/2017-10-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Android framework (gatekeeperresponse). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62998805." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-10-04T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0807", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101190", "name" : "101190", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securityfocus.com/bid/102131", "name" : "102131", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-12-01", "name" : "https://source.android.com/security/bulletin/2017-12-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Android framework (ui framework). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35056974." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 9.8, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 3.9, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 10.0 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 10.0, "acInsufInfo" : false, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-10-04T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0808", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101190", "name" : "101190", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/libcore/+/809681f310663288e83587089abb7715c68f6924", "name" : "https://android.googlesource.com/platform/libcore/+/809681f310663288e83587089abb7715c68f6924", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Vendor Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Android framework (file system). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62301183." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "acInsufInfo" : true, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-10-04T01:29Z", "lastModifiedDate" : "2017-10-12T13:30Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0809", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101088", "name" : "101088", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/frameworks/av/+/552a3b5df2a6876d10da20f72e4cc0d44ac2c790", "name" : "https://android.googlesource.com/platform/frameworks/av/+/552a3b5df2a6876d10da20f72e4cc0d44ac2c790", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Vendor Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-10-01", "name" : "https://source.android.com/security/bulletin/2017-10-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62673128." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-10-04T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0810", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101088", "name" : "101088", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/external/libmpeg2/+/7737780815fe523ad7b0e49456eb75d27a30818a", "name" : "https://android.googlesource.com/platform/external/libmpeg2/+/7737780815fe523ad7b0e49456eb75d27a30818a", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Vendor Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-10-01", "name" : "https://source.android.com/security/bulletin/2017-10-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-38207066." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-10-04T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0811", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101088", "name" : "101088", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/external/libhevc/+/25c0ffbe6a181b4a373c3c9b421ea449d457e6ed", "name" : "https://android.googlesource.com/platform/external/libhevc/+/25c0ffbe6a181b4a373c3c9b421ea449d457e6ed", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Vendor Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-10-01", "name" : "https://source.android.com/security/bulletin/2017-10-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-37930177." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-10-04T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0812", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-125" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101088", "name" : "101088", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/device/google/dragon/+/7df7ec13b1d222ac3a66797fbe432605ea8f973f", "name" : "https://android.googlesource.com/device/google/dragon/+/7df7ec13b1d222ac3a66797fbe432605ea8f973f", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Vendor Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-10-01", "name" : "https://source.android.com/security/bulletin/2017-10-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Android media framework (audio hal). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62873231." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-10-04T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0813", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-772" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101151", "name" : "101151", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/frameworks/av/+/7fa3f552a6f34ed05c15e64ea30b8eed53f77a41", "name" : "https://android.googlesource.com/platform/frameworks/av/+/7fa3f552a6f34ed05c15e64ea30b8eed53f77a41", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Vendor Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-36531046." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-10-04T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0814", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101151", "name" : "101151", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/external/tremolo/+/eeb4e45d5683f88488c083ecf142dc89bc3f0b47", "name" : "https://android.googlesource.com/platform/external/tremolo/+/eeb4e45d5683f88488c083ecf142dc89bc3f0b47", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Vendor Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62800140." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.8 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.9, "acInsufInfo" : true, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-10-04T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0815", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101088", "name" : "101088", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/frameworks/av/+/f490fc335772a9b14e78997486f4a572b0594c04", "name" : "https://android.googlesource.com/platform/frameworks/av/+/f490fc335772a9b14e78997486f4a572b0594c04", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Vendor Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-10-01", "name" : "https://source.android.com/security/bulletin/2017-10-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Android media framework (libeffects). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63526567." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-10-04T01:29Z", "lastModifiedDate" : "2017-10-12T13:58Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0816", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101088", "name" : "101088", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/frameworks/av/+/f490fc335772a9b14e78997486f4a572b0594c04", "name" : "https://android.googlesource.com/platform/frameworks/av/+/f490fc335772a9b14e78997486f4a572b0594c04", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Vendor Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/2017-10-01", "name" : "https://source.android.com/security/bulletin/2017-10-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Android media framework (libeffects). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63662938." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-10-04T01:29Z", "lastModifiedDate" : "2017-10-12T13:56Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0817", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101151", "name" : "101151", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/frameworks/av/+/d834160d9759f1098df692b34e6eeb548f9e317b", "name" : "https://android.googlesource.com/platform/frameworks/av/+/d834160d9759f1098df692b34e6eeb548f9e317b", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Vendor Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63522430." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "acInsufInfo" : true, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-10-04T01:29Z", "lastModifiedDate" : "2017-10-12T13:55Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0818", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-772" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101151", "name" : "101151", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/frameworks/av/+/d07f5c14e811951ff9b411ceb84e7288e0d04aaf", "name" : "https://android.googlesource.com/platform/frameworks/av/+/d07f5c14e811951ff9b411ceb84e7288e0d04aaf", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63581671." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.8 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.9, "acInsufInfo" : true, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-10-04T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0819", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-682" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101151", "name" : "101151", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/external/libhevc/+/87fb7909c49e6a4510ba86ace1ffc83459c7e1b9", "name" : "https://android.googlesource.com/platform/external/libhevc/+/87fb7909c49e6a4510ba86ace1ffc83459c7e1b9", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63045918." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.8 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.9, "acInsufInfo" : true, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-10-04T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0820", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101151", "name" : "101151", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://android.googlesource.com/platform/frameworks/av/+/8a3a2f6ea7defe1a81bb32b3c9f3537f84749b9d", "name" : "https://android.googlesource.com/platform/frameworks/av/+/8a3a2f6ea7defe1a81bb32b3c9f3537f84749b9d", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62187433." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.8 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.9, "acInsufInfo" : true, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-10-04T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0822", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://android.googlesource.com/platform/frameworks/base/+/c574568aaede7f652432deb7707f20ae54bbdf9a", "name" : "https://android.googlesource.com/platform/frameworks/base/+/c574568aaede7f652432deb7707f20ae54bbdf9a", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Vendor Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Android system (camera). Product: Android. Versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63787722." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 9.8, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 3.9, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 7.5 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.4, "acInsufInfo" : true, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-10-04T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0823", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "4.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.1", "version_affected" : "=" }, { "version_value" : "4.1.2", "version_affected" : "=" }, { "version_value" : "4.2", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.3", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.4", "version_affected" : "=" }, { "version_value" : "4.4.1", "version_affected" : "=" }, { "version_value" : "4.4.2", "version_affected" : "=" }, { "version_value" : "4.4.3", "version_affected" : "=" }, { "version_value" : "4.4.4", "version_affected" : "=" }, { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://android.googlesource.com/platform/hardware/ril/+/cd5f15f588a5d27e99ba12f057245bfe507f8c42", "name" : "https://android.googlesource.com/platform/hardware/ril/+/cd5f15f588a5d27e99ba12f057245bfe507f8c42", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Vendor Advisory" ] }, { "url" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Android system (rild). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37896655." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-10-04T01:29Z", "lastModifiedDate" : "2017-10-12T13:55Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0824", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "8.0", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Broadcom wifi driver. Product: Android. Versions: Android kernel. Android ID: A-37622847. References: B-V2017063001." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "8.0" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 9.8, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 3.9, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 7.5 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-10-04T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0825", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "8.0", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Broadcom wifi driver. Product: Android. Versions: Android kernel. Android ID: A-37305633. References: B-V2017063002." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "8.0" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-10-04T01:29Z", "lastModifiedDate" : "2017-10-12T15:43Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0826", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "8.0", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the HTC bootloader. Product: Android. Versions: Android kernel. Android ID: A-34949781." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "8.0" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-10-04T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0827", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "8.0", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101120", "name" : "101120", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-10-01", "name" : "https://source.android.com/security/bulletin/2017-10-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the MediaTek soc driver. Product: Android. Versions: Android kernel. Android ID: A-62539960. References: M-ALPS03353876, M-ALPS03353861, M-ALPS03353869, M-ALPS03353867, M-ALPS03353872." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "8.0" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-10-04T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0828", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "8.0", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Huawei bootloader. Product: Android. Versions: Android kernel. Android ID: A-34622855." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "8.0" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 9.8, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 3.9, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 7.5 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-10-04T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0829", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "8.0", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-10-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Motorola bootloader. Product: Android. Versions: Android kernel. Android ID: A-62345044." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*", "versionEndIncluding" : "8.0" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 9.8, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 3.9, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 7.5 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-10-04T01:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0830", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-732" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101775", "name" : "101775", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-11-01", "name" : "https://source.android.com/security/bulletin/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Android framework (device policy client). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62623498." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0831", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-732" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101775", "name" : "101775", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-11-01", "name" : "https://source.android.com/security/bulletin/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Android framework (window manager). Product: Android. Versions: 8.0. Android ID: A-37442941." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0832", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101717", "name" : "101717", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-11-01", "name" : "https://source.android.com/security/bulletin/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62887820." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0833", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101717", "name" : "101717", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-11-01", "name" : "https://source.android.com/security/bulletin/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62896384." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0834", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-787" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101717", "name" : "101717", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-11-01", "name" : "https://source.android.com/security/bulletin/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63125953." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0835", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101717", "name" : "101717", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-11-01", "name" : "https://source.android.com/security/bulletin/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63316832." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0836", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-129" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101717", "name" : "101717", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-11-01", "name" : "https://source.android.com/security/bulletin/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-64893226." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0837", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/102126", "name" : "102126", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-12-01", "name" : "https://source.android.com/security/bulletin/2017-12-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Android media framework (libaudiopolicymanager). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-64340921." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-12-06T14:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0838", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-63522818." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0839", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101717", "name" : "101717", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-11-01", "name" : "https://source.android.com/security/bulletin/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Android media framework (libeffects). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-64478003." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2017-12-07T21:07Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0840", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101717", "name" : "101717", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-11-01", "name" : "https://source.android.com/security/bulletin/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62948670." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2017-12-07T21:07Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0841", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-190" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101718", "name" : "101718", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-11-01", "name" : "https://source.android.com/security/bulletin/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android system (libutils). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-37723026." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0842", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/101718", "name" : "101718", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-11-01", "name" : "https://source.android.com/security/bulletin/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Android system (bluetooth). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-37502513." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0843", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/2017-11-01", "name" : "https://source.android.com/security/bulletin/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the MediaTek ccci. Product: Android. Versions: Android kernel. Android ID: A-62670819. References: M-ALPS03361488." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0845", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-732" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android framework (syncstorageengine). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35028827." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0846", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" }, { "version_value" : "8.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/pixel/2018-01-01", "name" : "https://source.android.com/security/bulletin/pixel/2018-01-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Android framework (clipboardservice). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-64934810." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2018-01-12T23:29Z", "lastModifiedDate" : "2018-02-01T20:44Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0847", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-276" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Android media framework (mediaanalytics). Product: Android. Versions: 8.0. Android ID: A-65540999." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 9.8, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 3.9, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 7.5 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0848", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Android media framework (libeffects). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-64477217." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 3.9, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2017-12-07T21:11Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0849", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62688399." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 3.9, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2017-12-07T21:11Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0850", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-64836941." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 3.9, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2017-12-07T21:11Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0851", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-35430570." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 3.9, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2017-12-07T21:11Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0852", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-787" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0. Android ID: A-62815506." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.8 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0853", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63121644." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 9.1, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 3.9, "impactScore" : 5.2 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 8.5 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 7.8, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0854", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-125" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63873837." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 9.1, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 3.9, "impactScore" : 5.2 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 8.5 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 7.8, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0855", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-772" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/102414", "name" : "102414", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1040106", "name" : "1040106", "refsource" : "SECTRACK", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2018-01-01", "name" : "https://source.android.com/security/bulletin/2018-01-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "In MPEG4Extractor.cpp, there are several places where functions return early without cleaning up internal buffers which could lead to memory leaks. This could lead to remote denial of service of a critical system process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-64452857." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.8 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2018-01-12T23:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0857", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-369" }, { "lang" : "en", "value" : "CWE-681" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Another vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-65122447." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.8 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0858", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Another vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-64836894." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.8 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0859", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Another vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-36075131." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.8 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0860", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Android system (inputdispatcher). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-31097064." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "LOW", "baseScore" : 5.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.8, "impactScore" : 3.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 4.6 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.9, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0861", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-416" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://lists.alioth.debian.org/pipermail/secure-testing-commits/2017-December/059967.html", "name" : "[secure-testing-commits] 20171206 r58306 - data/CVE", "refsource" : "MLIST", "tags" : [ ] }, { "url" : "http://www.securityfocus.com/bid/102329", "name" : "102329", "refsource" : "BID", "tags" : [ ] }, { "url" : "https://access.redhat.com/errata/RHSA-2018:2390", "name" : "RHSA-2018:2390", "refsource" : "REDHAT", "tags" : [ ] }, { "url" : "https://access.redhat.com/errata/RHSA-2018:3083", "name" : "RHSA-2018:3083", "refsource" : "REDHAT", "tags" : [ ] }, { "url" : "https://access.redhat.com/errata/RHSA-2018:3096", "name" : "RHSA-2018:3096", "refsource" : "REDHAT", "tags" : [ ] }, { "url" : "https://access.redhat.com/errata/RHSA-2020:0036", "name" : "RHSA-2020:0036", "refsource" : "REDHAT", "tags" : [ ] }, { "url" : "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=362bca57f5d78220f8b5907b875961af9436e229", "name" : "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=362bca57f5d78220f8b5907b875961af9436e229", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0", "name" : "https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://lists.debian.org/debian-lts-announce/2018/05/msg00000.html", "name" : "[debian-lts-announce] 20180502 [SECURITY] [DLA 1369-1] linux security update", "refsource" : "MLIST", "tags" : [ ] }, { "url" : "https://security-tracker.debian.org/tracker/CVE-2017-0861", "name" : "https://security-tracker.debian.org/tracker/CVE-2017-0861", "refsource" : "CONFIRM", "tags" : [ ] }, { "url" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://usn.ubuntu.com/3583-1/", "name" : "USN-3583-1", "refsource" : "UBUNTU", "tags" : [ ] }, { "url" : "https://usn.ubuntu.com/3583-2/", "name" : "USN-3583-2", "refsource" : "UBUNTU", "tags" : [ ] }, { "url" : "https://usn.ubuntu.com/3617-1/", "name" : "USN-3617-1", "refsource" : "UBUNTU", "tags" : [ ] }, { "url" : "https://usn.ubuntu.com/3617-2/", "name" : "USN-3617-2", "refsource" : "UBUNTU", "tags" : [ ] }, { "url" : "https://usn.ubuntu.com/3617-3/", "name" : "USN-3617-3", "refsource" : "UBUNTU", "tags" : [ ] }, { "url" : "https://usn.ubuntu.com/3619-1/", "name" : "USN-3619-1", "refsource" : "UBUNTU", "tags" : [ ] }, { "url" : "https://usn.ubuntu.com/3619-2/", "name" : "USN-3619-2", "refsource" : "UBUNTU", "tags" : [ ] }, { "url" : "https://usn.ubuntu.com/3632-1/", "name" : "USN-3632-1", "refsource" : "UBUNTU", "tags" : [ ] }, { "url" : "https://www.debian.org/security/2018/dsa-4187", "name" : "DSA-4187", "refsource" : "DEBIAN", "tags" : [ ] }, { "url" : "https://www.oracle.com/security-alerts/cpujul2020.html", "name" : "https://www.oracle.com/security-alerts/cpujul2020.html", "refsource" : "MISC", "tags" : [ ] }, { "url" : "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html", "name" : "https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html", "refsource" : "MISC", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows attackers to gain privileges via unspecified vectors." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 4.6 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.9, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2020-07-15T03:15Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0862", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Upstream kernel kernel. Product: Android. Versions: Android kernel. Android ID: A-36006779." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0863", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Upstream kernel video driver. Product: Android. Versions: Android kernel. Android ID: A-37950620." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 4.6 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.9, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0864", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the MediaTek ioctl (flashlight). Product: Android. Versions: Android kernel. Android ID: A-37277147. References: M-ALPS03394571." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 4.6 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.9, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0865", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "*", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-11-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the MediaTek soc driver. Product: Android. Versions: Android kernel. Android ID: A-65025090. References: M-ALPS02973195." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:*:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 4.6 }, "severity" : "MEDIUM", "exploitabilityScore" : 3.9, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-16T23:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0866", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nvidia", "product" : { "product_data" : [ { "product_name" : "tegra_x1_firmware", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-119" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/pixel/2017-11-01#announcements", "name" : "https://source.android.com/security/bulletin/pixel/2017-11-01#announcements", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Direct rendering infrastructure of the NVIDIA Tegra X1 where an unchecked input from userspace is passed as a pointer to kfree. This could lead to kernel memory corruption and possible code execution. This issue is rated as moderate. Product: Pixel. Version: N/A. Android ID: A-38415808. References: N-CVE-2017-0866." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "AND", "children" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:nvidia:tegra_x1_firmware:-:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : false, "cpe23Uri" : "cpe:2.3:h:nvidia:tegra_x1:-:*:*:*:*:*:*:*" } ] } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-16T22:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0869", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "-", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-190" }, { "lang" : "en", "value" : "CWE-416" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/102374", "name" : "102374", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1040106", "name" : "1040106", "refsource" : "SECTRACK", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2018-01-01", "name" : "https://source.android.com/security/bulletin/2018-01-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "NVIDIA driver contains an integer overflow vulnerability which could cause a use after free and possibly lead to an elevation of privilege enabling code execution as a privileged process. This issue is rated as high. Version: N/A. Android ID: A-37776156. References: N-CVE-2017-0869." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2018-01-12T15:29Z", "lastModifiedDate" : "2018-02-01T20:45Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0870", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/102131", "name" : "102131", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-12-01", "name" : "https://source.android.com/security/bulletin/2017-12-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Android framework (libminikin). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-62134807." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-12-06T14:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0871", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/102131", "name" : "102131", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-12-01", "name" : "https://source.android.com/security/bulletin/2017-12-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An elevation of privilege vulnerability in the Android framework (framework base). Product: Android. Versions: 8.0. Android ID A-65281159." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "LOCAL", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 7.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 1.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:L/Au:N/C:C/I:C/A:C", "accessVector" : "LOCAL", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.2 }, "severity" : "HIGH", "exploitabilityScore" : 3.9, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-12-06T14:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0872", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/102126", "name" : "102126", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-12-01", "name" : "https://source.android.com/security/bulletin/2017-12-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libskia). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65290323." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-12-06T14:29Z", "lastModifiedDate" : "2017-12-19T14:39Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0873", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/102126", "name" : "102126", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-12-01", "name" : "https://source.android.com/security/bulletin/2017-12-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63316255." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 6.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-12-06T14:29Z", "lastModifiedDate" : "2017-12-19T14:38Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0874", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/102126", "name" : "102126", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-12-01", "name" : "https://source.android.com/security/bulletin/2017-12-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63315932." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 6.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-12-06T14:29Z", "lastModifiedDate" : "2017-12-19T14:38Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0876", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/102126", "name" : "102126", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-12-01", "name" : "https://source.android.com/security/bulletin/2017-12-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0. Android ID A-64964675." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-12-06T14:29Z", "lastModifiedDate" : "2017-12-19T14:43Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0877", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "6.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/102126", "name" : "102126", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-12-01", "name" : "https://source.android.com/security/bulletin/2017-12-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0. Android ID A-66372937." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-12-06T14:29Z", "lastModifiedDate" : "2017-12-19T14:43Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0878", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/102126", "name" : "102126", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-12-01", "name" : "https://source.android.com/security/bulletin/2017-12-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 8.0. Android ID A-65186291." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:C/I:C/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "COMPLETE", "integrityImpact" : "COMPLETE", "availabilityImpact" : "COMPLETE", "baseScore" : 9.3 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 10.0, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-12-06T14:29Z", "lastModifiedDate" : "2017-12-19T14:43Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0879", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "5.1.1", "version_affected" : "=" }, { "version_value" : "6.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://source.android.com/security/bulletin/pixel/2017-12-01", "name" : "https://source.android.com/security/bulletin/pixel/2017-12-01", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65025028." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 9.1, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 3.9, "impactScore" : 5.2 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 8.5 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 7.8, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-12-06T14:29Z", "lastModifiedDate" : "2017-12-19T15:53Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0880", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "google", "product" : { "product_data" : [ { "product_name" : "android", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.1.2", "version_affected" : "=" }, { "version_value" : "8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/102126", "name" : "102126", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://source.android.com/security/bulletin/2017-12-01", "name" : "https://source.android.com/security/bulletin/2017-12-01", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "A denial of service vulnerability in the Android media framework (libskia). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID A-65646012." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 6.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:N/A:C", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "COMPLETE", "baseScore" : 7.1 }, "severity" : "HIGH", "exploitabilityScore" : 8.6, "impactScore" : 6.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-12-06T14:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0881", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "zulip", "product" : { "product_data" : [ { "product_name" : "zulip_server", "version" : { "version_data" : [ { "version_value" : "1.1.5", "version_affected" : "=" }, { "version_value" : "1.2.0", "version_affected" : "=" }, { "version_value" : "1.2.1", "version_affected" : "=" }, { "version_value" : "1.3.0", "version_affected" : "=" }, { "version_value" : "1.3.1", "version_affected" : "=" }, { "version_value" : "1.3.2", "version_affected" : "=" }, { "version_value" : "1.3.3", "version_affected" : "=" }, { "version_value" : "1.3.4", "version_affected" : "=" }, { "version_value" : "1.3.5", "version_affected" : "=" }, { "version_value" : "1.3.6", "version_affected" : "=" }, { "version_value" : "1.3.7", "version_affected" : "=" }, { "version_value" : "1.3.8", "version_affected" : "=" }, { "version_value" : "1.3.9", "version_affected" : "=" }, { "version_value" : "1.3.10", "version_affected" : "=" }, { "version_value" : "1.3.11", "version_affected" : "=" }, { "version_value" : "1.3.12", "version_affected" : "=" }, { "version_value" : "1.3.13", "version_affected" : "=" }, { "version_value" : "1.4.0", "version_affected" : "=" }, { "version_value" : "1.4.1", "version_affected" : "=" }, { "version_value" : "1.4.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-863" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97159", "name" : "97159", "refsource" : "BID", "tags" : [ "Third Party Advisory", "Vendor Advisory" ] }, { "url" : "https://github.com/zulip/zulip/commit/7ecda1ac8e26d8fb3725e954b2dc4723dda2255f", "name" : "https://github.com/zulip/zulip/commit/7ecda1ac8e26d8fb3725e954b2dc4723dda2255f", "refsource" : "MISC", "tags" : [ "Patch", "Third Party Advisory" ] }, { "url" : "https://groups.google.com/d/msg/zulip-announce/VyawgRuoY34/NTBwnTArGwAJ", "name" : "https://groups.google.com/d/msg/zulip-announce/VyawgRuoY34/NTBwnTArGwAJ", "refsource" : "MISC", "tags" : [ "Patch", "Release Notes", "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "An error in the implementation of an autosubscribe feature in the check_stream_exists route of the Zulip group chat application server before 1.4.3 allowed an authenticated user to subscribe to a private stream that should have required an invitation from an existing member to join. The issue affects all previously released versions of the Zulip server." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:zulip:zulip_server:*:*:*:*:*:*:*:*", "versionEndExcluding" : "1.4.3" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:S/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "SINGLE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.0, "impactScore" : 2.9, "acInsufInfo" : false, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-28T02:59Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0882", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "gitlab", "product" : { "product_data" : [ { "product_name" : "gitlab", "version" : { "version_data" : [ { "version_value" : "8.2.0", "version_affected" : "=" }, { "version_value" : "8.2.1", "version_affected" : "=" }, { "version_value" : "8.2.2", "version_affected" : "=" }, { "version_value" : "8.2.3", "version_affected" : "=" }, { "version_value" : "8.2.4", "version_affected" : "=" }, { "version_value" : "8.2.5", "version_affected" : "=" }, { "version_value" : "8.3.0", "version_affected" : "=" }, { "version_value" : "8.3.8", "version_affected" : "=" }, { "version_value" : "8.3.9", "version_affected" : "=" }, { "version_value" : "8.4.0", "version_affected" : "=" }, { "version_value" : "8.4.9", "version_affected" : "=" }, { "version_value" : "8.4.10", "version_affected" : "=" }, { "version_value" : "8.5.0", "version_affected" : "=" }, { "version_value" : "8.5.11", "version_affected" : "=" }, { "version_value" : "8.5.12", "version_affected" : "=" }, { "version_value" : "8.6.0", "version_affected" : "=" }, { "version_value" : "8.6.7", "version_affected" : "=" }, { "version_value" : "8.6.8", "version_affected" : "=" }, { "version_value" : "8.7.0", "version_affected" : "=" }, { "version_value" : "8.7.1", "version_affected" : "=" }, { "version_value" : "8.10.0", "version_affected" : "=" }, { "version_value" : "8.10.12", "version_affected" : "=" }, { "version_value" : "8.10.13", "version_affected" : "=" }, { "version_value" : "8.11.0", "version_affected" : "=" }, { "version_value" : "8.11.9", "version_affected" : "=" }, { "version_value" : "8.11.10", "version_affected" : "=" }, { "version_value" : "8.12.0", "version_affected" : "=" }, { "version_value" : "8.12.7", "version_affected" : "=" }, { "version_value" : "8.12.8", "version_affected" : "=" }, { "version_value" : "8.13.0", "version_affected" : "=" }, { "version_value" : "8.13.2", "version_affected" : "=" }, { "version_value" : "8.13.3", "version_affected" : "=" }, { "version_value" : "8.14.0", "version_affected" : "=" }, { "version_value" : "8.14.1", "version_affected" : "=" }, { "version_value" : "8.14.2", "version_affected" : "=" }, { "version_value" : "8.14.3", "version_affected" : "=" }, { "version_value" : "8.14.4", "version_affected" : "=" }, { "version_value" : "8.14.5", "version_affected" : "=" }, { "version_value" : "8.14.6", "version_affected" : "=" }, { "version_value" : "8.15.0", "version_affected" : "=" }, { "version_value" : "8.15.1", "version_affected" : "=" }, { "version_value" : "8.15.2", "version_affected" : "=" }, { "version_value" : "8.15.3", "version_affected" : "=" }, { "version_value" : "8.15.4", "version_affected" : "=" }, { "version_value" : "8.15.5", "version_affected" : "=" }, { "version_value" : "8.15.6", "version_affected" : "=" }, { "version_value" : "8.15.7", "version_affected" : "=" }, { "version_value" : "8.16.0", "version_affected" : "=" }, { "version_value" : "8.16.1", "version_affected" : "=" }, { "version_value" : "8.16.2", "version_affected" : "=" }, { "version_value" : "8.16.3", "version_affected" : "=" }, { "version_value" : "8.16.4", "version_affected" : "=" }, { "version_value" : "8.16.5", "version_affected" : "=" }, { "version_value" : "8.16.6", "version_affected" : "=" }, { "version_value" : "8.16.7", "version_affected" : "=" }, { "version_value" : "8.17.0", "version_affected" : "=" }, { "version_value" : "8.17.1", "version_affected" : "=" }, { "version_value" : "8.17.2", "version_affected" : "=" }, { "version_value" : "8.17.3", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97157", "name" : "97157", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://about.gitlab.com/2017/03/20/gitlab-8-dot-17-dot-4-security-release/", "name" : "https://about.gitlab.com/2017/03/20/gitlab-8-dot-17-dot-4-security-release/", "refsource" : "MISC", "tags" : [ "Release Notes", "Vendor Advisory" ] }, { "url" : "https://gitlab.com/gitlab-org/gitlab-ce/commit/43f5a2739dbf8f5c4c16a79f98e2630888f6b5d1", "name" : "https://gitlab.com/gitlab-org/gitlab-ce/commit/43f5a2739dbf8f5c4c16a79f98e2630888f6b5d1", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://gitlab.com/gitlab-org/gitlab-ce/commit/a70346fc6530aa28a98e4aa4cf0f40e2c3bcef6b", "name" : "https://gitlab.com/gitlab-org/gitlab-ce/commit/a70346fc6530aa28a98e4aa4cf0f40e2c3bcef6b", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://gitlab.com/gitlab-org/gitlab-ce/commit/cdf396f456472ef8decd9598daa8dc0097cd30c5", "name" : "https://gitlab.com/gitlab-org/gitlab-ce/commit/cdf396f456472ef8decd9598daa8dc0097cd30c5", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "https://gitlab.com/gitlab-org/gitlab-ce/issues/29661", "name" : "https://gitlab.com/gitlab-org/gitlab-ce/issues/29661", "refsource" : "MISC", "tags" : [ "Exploit", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request. A fix was included in versions 8.15.8, 8.16.7, and 8.17.4, which were released on March 20th 2017 at 23:59 UTC." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.2.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.2.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.2.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.2.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.3.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.3.8:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.3.9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.4.9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.4.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.5.11:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.5.12:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.6.7:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.6.8:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.7.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.10.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.10.12:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.10.13:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.11.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.11.9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.11.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.12.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.12.7:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.12.8:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.13.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.13.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.13.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.14.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.14.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.14.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.14.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.14.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.14.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.14.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.15.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.15.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.15.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.15.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.15.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.15.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.15.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.15.7:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.16.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.16.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.16.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.16.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.16.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.16.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.16.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.16.7:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.17.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.17.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.17.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:8.17.3:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "LOW", "baseScore" : 6.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 3.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:S/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "SINGLE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.0, "impactScore" : 2.9, "acInsufInfo" : true, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-03-28T02:59Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0883", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nextcloud", "product" : { "product_data" : [ { "product_name" : "nextcloud_server", "version" : { "version_data" : [ { "version_value" : "9.0.54", "version_affected" : "<=" }, { "version_value" : "10.0.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-732" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://hackerone.com/reports/169680", "name" : "https://hackerone.com/reports/169680", "refsource" : "MISC", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://nextcloud.com/security/advisory/?id=nc-sa-2017-001", "name" : "https://nextcloud.com/security/advisory/?id=nc-sa-2017-001", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Nextcloud Server before 9.0.55 and 10.0.2 suffers from a permission increase on re-sharing via OCS API issue. A permission related issue within the OCS sharing API allowed an authenticated adversary to reshare shared files with an increasing permission set. This may allow an attacker to edit files in a share despite having only a 'read' permission set. Note that this only affects folders and files that the adversary has at least read-only permissions for." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*", "versionEndIncluding" : "9.0.54" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nextcloud:nextcloud_server:10.0.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "CHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 6.4, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 3.1, "impactScore" : 2.7 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:S/C:P/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "SINGLE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 5.5 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.0, "impactScore" : 4.9, "acInsufInfo" : false, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-05T20:59Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0884", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nextcloud", "product" : { "product_data" : [ { "product_name" : "nextcloud", "version" : { "version_data" : [ { "version_value" : "9.0.54", "version_affected" : "<=" }, { "version_value" : "10.0.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-732" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://hackerone.com/reports/169680", "name" : "https://hackerone.com/reports/169680", "refsource" : "MISC", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://nextcloud.com/security/advisory/?id=nc-sa-2017-002", "name" : "https://nextcloud.com/security/advisory/?id=nc-sa-2017-002", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Nextcloud Server before 9.0.55 and 10.0.2 suffers from a creation of folders in read-only folders despite lacking permissions issue. Due to a logical error in the file caching layer an authenticated adversary is able to create empty folders inside a shared folder. Note that this only affects folders and files that the adversary has at least read-only permissions for." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*", "versionEndIncluding" : "9.0.54" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nextcloud:nextcloud:10.0.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:S/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "SINGLE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-05T20:59Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0885", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nextcloud", "product" : { "product_data" : [ { "product_name" : "nextcloud", "version" : { "version_data" : [ { "version_value" : "9.0.54", "version_affected" : "<=" }, { "version_value" : "10.0.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://hackerone.com/reports/174524", "name" : "https://hackerone.com/reports/174524", "refsource" : "MISC", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://nextcloud.com/security/advisory/?id=nc-sa-2017-003", "name" : "https://nextcloud.com/security/advisory/?id=nc-sa-2017-003", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Nextcloud Server before 9.0.55 and 10.0.2 suffers from a error message disclosing existence of file in write-only share. Due to an error in the application logic an adversary with access to a write-only share may enumerate the names of existing files and subfolders by comparing the exception messages." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*", "versionEndIncluding" : "9.0.54" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nextcloud:nextcloud:10.0.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:S/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "SINGLE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-05T20:59Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0886", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nextcloud", "product" : { "product_data" : [ { "product_name" : "nextcloud", "version" : { "version_data" : [ { "version_value" : "9.0.54", "version_affected" : "<=" }, { "version_value" : "10.0.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-400" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://hackerone.com/reports/174524", "name" : "https://hackerone.com/reports/174524", "refsource" : "MISC", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://nextcloud.com/security/advisory/?id=nc-sa-2017-004", "name" : "https://nextcloud.com/security/advisory/?id=nc-sa-2017-004", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Denial of Service attack. Due to an error in the application logic an authenticated adversary may trigger an endless recursion in the application leading to a potential Denial of Service." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*", "versionEndIncluding" : "9.0.54" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nextcloud:nextcloud:10.0.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 6.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:S/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "SINGLE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 4.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-05T20:59Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0887", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nextcloud", "product" : { "product_data" : [ { "product_name" : "nextcloud", "version" : { "version_data" : [ { "version_value" : "9.0.54", "version_affected" : "<=" }, { "version_value" : "10.0.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://hackerone.com/reports/173622", "name" : "https://hackerone.com/reports/173622", "refsource" : "MISC", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://nextcloud.com/security/advisory/?id=nc-sa-2017-005", "name" : "https://nextcloud.com/security/advisory/?id=nc-sa-2017-005", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Nextcloud Server before 9.0.55 and 10.0.2 suffers from a bypass in the quota limitation. Due to not properly sanitizing values provided by the `OC-Total-Length` HTTP header an authenticated adversary may be able to exceed their configured user quota. Thus using more space than allowed by the administrator." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*", "versionEndIncluding" : "9.0.54" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nextcloud:nextcloud:10.0.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:S/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "SINGLE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-04-05T20:59Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0888", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nextcloud", "product" : { "product_data" : [ { "product_name" : "nextcloud", "version" : { "version_data" : [ { "version_value" : "9.0.54", "version_affected" : "<=" }, { "version_value" : "10.0.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/97491", "name" : "97491", "refsource" : "BID", "tags" : [ ] }, { "url" : "https://hackerone.com/reports/179073", "name" : "https://hackerone.com/reports/179073", "refsource" : "MISC", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://nextcloud.com/security/advisory/?id=nc-sa-2017-006", "name" : "https://nextcloud.com/security/advisory/?id=nc-sa-2017-006", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Nextcloud Server before 9.0.55 and 10.0.2 suffers from a Content-Spoofing vulnerability in the \"files\" app. The top navigation bar displayed in the files list contained partially user-controllable input leading to a potential misrepresentation of information." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*", "versionEndIncluding" : "9.0.54" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nextcloud:nextcloud:10.0.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-04-05T20:59Z", "lastModifiedDate" : "2017-04-11T01:59Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0889", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "thoughtbot", "product" : { "product_data" : [ { "product_name" : "paperclip", "version" : { "version_data" : [ { "version_value" : "3.1.4", "version_affected" : "=" }, { "version_value" : "3.2.0", "version_affected" : "=" }, { "version_value" : "3.2.1", "version_affected" : "=" }, { "version_value" : "3.3.0", "version_affected" : "=" }, { "version_value" : "3.3.1", "version_affected" : "=" }, { "version_value" : "3.4.0", "version_affected" : "=" }, { "version_value" : "3.4.1", "version_affected" : "=" }, { "version_value" : "3.4.2", "version_affected" : "=" }, { "version_value" : "3.5.0", "version_affected" : "=" }, { "version_value" : "3.5.1", "version_affected" : "=" }, { "version_value" : "3.5.1.1", "version_affected" : "=" }, { "version_value" : "3.5.2", "version_affected" : "=" }, { "version_value" : "3.5.3", "version_affected" : "=" }, { "version_value" : "3.5.4", "version_affected" : "=" }, { "version_value" : "4.0.0", "version_affected" : "=" }, { "version_value" : "4.1.0", "version_affected" : "=" }, { "version_value" : "4.1.1", "version_affected" : "=" }, { "version_value" : "4.2.0", "version_affected" : "=" }, { "version_value" : "4.2.1", "version_affected" : "=" }, { "version_value" : "4.2.2", "version_affected" : "=" }, { "version_value" : "4.2.3", "version_affected" : "=" }, { "version_value" : "4.2.4", "version_affected" : "=" }, { "version_value" : "4.3.0", "version_affected" : "=" }, { "version_value" : "4.3.1", "version_affected" : "=" }, { "version_value" : "4.3.2", "version_affected" : "=" }, { "version_value" : "4.3.3", "version_affected" : "=" }, { "version_value" : "4.3.4", "version_affected" : "=" }, { "version_value" : "4.3.5", "version_affected" : "=" }, { "version_value" : "4.3.6", "version_affected" : "=" }, { "version_value" : "4.3.7", "version_affected" : "=" }, { "version_value" : "5.0.0", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-918" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://github.com/thoughtbot/paperclip/pull/2435", "name" : "https://github.com/thoughtbot/paperclip/pull/2435", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] }, { "url" : "https://hackerone.com/reports/209430", "name" : "https://hackerone.com/reports/209430", "refsource" : "MISC", "tags" : [ "Permissions Required" ] }, { "url" : "https://hackerone.com/reports/713", "name" : "https://hackerone.com/reports/713", "refsource" : "MISC", "tags" : [ "Issue Tracking", "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Paperclip ruby gem version 3.1.4 and later suffers from a Server-SIde Request Forgery (SSRF) vulnerability in the Paperclip::UriAdapter class. Attackers may be able to access information about internal network resources." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:thoughtbot:paperclip:*:*:*:*:*:ruby:*:*", "versionStartIncluding" : "3.1.4", "versionEndExcluding" : "5.2.0" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 9.8, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 3.9, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 7.5 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-13T17:29Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0890", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nextcloud", "product" : { "product_data" : [ { "product_name" : "nextcloud", "version" : { "version_data" : [ { "version_value" : "11.0.2", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-79" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://hackerone.com/reports/213227", "name" : "https://hackerone.com/reports/213227", "refsource" : "MISC", "tags" : [ "Permissions Required" ] }, { "url" : "https://nextcloud.com/security/advisory/?id=nc-sa-2017-007", "name" : "https://nextcloud.com/security/advisory/?id=nc-sa-2017-007", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*", "versionEndIncluding" : "11.0.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "REQUIRED", "scope" : "CHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 5.4, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.3, "impactScore" : 2.7 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:S/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 3.5 }, "severity" : "LOW", "exploitabilityScore" : 6.8, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-08T20:29Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0891", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nextcloud", "product" : { "product_data" : [ { "product_name" : "nextcloud_server", "version" : { "version_data" : [ { "version_value" : "1.0", "version_affected" : "=" }, { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.1", "version_affected" : "=" }, { "version_value" : "2.0", "version_affected" : "=" }, { "version_value" : "3.0", "version_affected" : "=" }, { "version_value" : "3.0.1", "version_affected" : "=" }, { "version_value" : "4.0.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.0.5", "version_affected" : "=" }, { "version_value" : "4.0.6", "version_affected" : "=" }, { "version_value" : "4.0.7", "version_affected" : "=" }, { "version_value" : "4.0.8", "version_affected" : "=" }, { "version_value" : "4.0.9", "version_affected" : "=" }, { "version_value" : "4.0.10", "version_affected" : "=" }, { "version_value" : "4.0.11", "version_affected" : "=" }, { "version_value" : "4.0.12", "version_affected" : "=" }, { "version_value" : "4.0.13", "version_affected" : "=" }, { "version_value" : "4.0.14", "version_affected" : "=" }, { "version_value" : "4.0.15", "version_affected" : "=" }, { "version_value" : "4.0.16", "version_affected" : "=" }, { "version_value" : "4.5.0", "version_affected" : "=" }, { "version_value" : "4.5.1", "version_affected" : "=" }, { "version_value" : "4.5.2", "version_affected" : "=" }, { "version_value" : "4.5.3", "version_affected" : "=" }, { "version_value" : "4.5.4", "version_affected" : "=" }, { "version_value" : "4.5.5", "version_affected" : "=" }, { "version_value" : "4.5.6", "version_affected" : "=" }, { "version_value" : "4.5.7", "version_affected" : "=" }, { "version_value" : "4.5.8", "version_affected" : "=" }, { "version_value" : "4.5.9", "version_affected" : "=" }, { "version_value" : "4.5.10", "version_affected" : "=" }, { "version_value" : "4.5.11", "version_affected" : "=" }, { "version_value" : "4.5.12", "version_affected" : "=" }, { "version_value" : "4.5.13", "version_affected" : "=" }, { "version_value" : "5.0.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.0.3", "version_affected" : "=" }, { "version_value" : "5.0.4", "version_affected" : "=" }, { "version_value" : "5.0.5", "version_affected" : "=" }, { "version_value" : "5.0.6", "version_affected" : "=" }, { "version_value" : "5.0.7", "version_affected" : "=" }, { "version_value" : "5.0.8", "version_affected" : "=" }, { "version_value" : "5.0.9", "version_affected" : "=" }, { "version_value" : "5.0.10", "version_affected" : "=" }, { "version_value" : "5.0.11", "version_affected" : "=" }, { "version_value" : "5.0.12", "version_affected" : "=" }, { "version_value" : "5.0.13", "version_affected" : "=" }, { "version_value" : "5.0.14", "version_affected" : "=" }, { "version_value" : "5.0.15", "version_affected" : "=" }, { "version_value" : "5.0.16", "version_affected" : "=" }, { "version_value" : "5.0.17", "version_affected" : "=" }, { "version_value" : "5.0.19", "version_affected" : "=" }, { "version_value" : "6.0.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "6.0.2", "version_affected" : "=" }, { "version_value" : "6.0.3", "version_affected" : "=" }, { "version_value" : "6.0.4", "version_affected" : "=" }, { "version_value" : "6.0.5", "version_affected" : "=" }, { "version_value" : "6.0.6", "version_affected" : "=" }, { "version_value" : "6.0.7", "version_affected" : "=" }, { "version_value" : "6.0.8", "version_affected" : "=" }, { "version_value" : "6.0.9", "version_affected" : "=" }, { "version_value" : "6.0.10", "version_affected" : "=" }, { "version_value" : "7.0.0", "version_affected" : "=" }, { "version_value" : "7.0.1", "version_affected" : "=" }, { "version_value" : "7.0.2", "version_affected" : "=" }, { "version_value" : "7.0.3", "version_affected" : "=" }, { "version_value" : "7.0.4", "version_affected" : "=" }, { "version_value" : "7.0.5", "version_affected" : "=" }, { "version_value" : "7.0.6", "version_affected" : "=" }, { "version_value" : "7.0.7", "version_affected" : "=" }, { "version_value" : "7.0.8", "version_affected" : "=" }, { "version_value" : "7.0.9", "version_affected" : "=" }, { "version_value" : "7.0.10", "version_affected" : "=" }, { "version_value" : "7.0.11", "version_affected" : "=" }, { "version_value" : "7.0.12", "version_affected" : "=" }, { "version_value" : "7.0.13", "version_affected" : "=" }, { "version_value" : "7.0.14", "version_affected" : "=" }, { "version_value" : "7.0.15", "version_affected" : "=" }, { "version_value" : "8.0.0", "version_affected" : "=" }, { "version_value" : "8.0.1", "version_affected" : "=" }, { "version_value" : "8.0.2", "version_affected" : "=" }, { "version_value" : "8.0.3", "version_affected" : "=" }, { "version_value" : "8.0.4", "version_affected" : "=" }, { "version_value" : "8.0.5", "version_affected" : "=" }, { "version_value" : "8.0.6", "version_affected" : "=" }, { "version_value" : "8.0.7", "version_affected" : "=" }, { "version_value" : "8.0.8", "version_affected" : "=" }, { "version_value" : "8.0.9", "version_affected" : "=" }, { "version_value" : "8.0.10", "version_affected" : "=" }, { "version_value" : "8.0.11", "version_affected" : "=" }, { "version_value" : "8.0.12", "version_affected" : "=" }, { "version_value" : "8.0.13", "version_affected" : "=" }, { "version_value" : "8.0.14", "version_affected" : "=" }, { "version_value" : "8.0.15", "version_affected" : "=" }, { "version_value" : "8.0.16", "version_affected" : "=" }, { "version_value" : "8.1", "version_affected" : "=" }, { "version_value" : "8.1.0", "version_affected" : "=" }, { "version_value" : "8.1.1", "version_affected" : "=" }, { "version_value" : "8.1.2", "version_affected" : "=" }, { "version_value" : "8.1.3", "version_affected" : "=" }, { "version_value" : "8.1.4", "version_affected" : "=" }, { "version_value" : "8.1.5", "version_affected" : "=" }, { "version_value" : "8.1.6", "version_affected" : "=" }, { "version_value" : "8.1.7", "version_affected" : "=" }, { "version_value" : "8.1.8", "version_affected" : "=" }, { "version_value" : "8.1.9", "version_affected" : "=" }, { "version_value" : "8.1.10", "version_affected" : "=" }, { "version_value" : "8.1.11", "version_affected" : "=" }, { "version_value" : "8.2", "version_affected" : "=" }, { "version_value" : "8.2.0", "version_affected" : "=" }, { "version_value" : "8.2.1", "version_affected" : "=" }, { "version_value" : "8.2.2", "version_affected" : "=" }, { "version_value" : "8.2.3", "version_affected" : "=" }, { "version_value" : "8.2.4", "version_affected" : "=" }, { "version_value" : "8.2.5", "version_affected" : "=" }, { "version_value" : "8.2.6", "version_affected" : "=" }, { "version_value" : "8.2.7", "version_affected" : "=" }, { "version_value" : "8.2.8", "version_affected" : "=" }, { "version_value" : "8.2.9", "version_affected" : "=" }, { "version_value" : "9.0", "version_affected" : "=" }, { "version_value" : "9.0.0", "version_affected" : "=" }, { "version_value" : "9.0.1", "version_affected" : "=" }, { "version_value" : "9.0.2", "version_affected" : "=" }, { "version_value" : "9.0.3", "version_affected" : "=" }, { "version_value" : "9.0.4", "version_affected" : "=" }, { "version_value" : "9.0.5", "version_affected" : "=" }, { "version_value" : "9.0.6", "version_affected" : "=" }, { "version_value" : "9.0.7", "version_affected" : "=" }, { "version_value" : "9.0.50", "version_affected" : "=" }, { "version_value" : "9.0.51", "version_affected" : "=" }, { "version_value" : "9.0.52", "version_affected" : "=" }, { "version_value" : "9.0.53", "version_affected" : "=" }, { "version_value" : "9.0.54", "version_affected" : "=" }, { "version_value" : "9.0.55", "version_affected" : "=" }, { "version_value" : "9.0.56", "version_affected" : "=" }, { "version_value" : "9.0.57", "version_affected" : "=" }, { "version_value" : "10.0.0", "version_affected" : "=" }, { "version_value" : "10.0.1", "version_affected" : "=" }, { "version_value" : "10.0.2", "version_affected" : "=" }, { "version_value" : "10.0.3", "version_affected" : "=" }, { "version_value" : "10.0.4", "version_affected" : "=" }, { "version_value" : "11.0.0", "version_affected" : "=" }, { "version_value" : "11.0.1", "version_affected" : "=" }, { "version_value" : "11.0.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-79" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://hackerone.com/reports/216812", "name" : "https://hackerone.com/reports/216812", "refsource" : "MISC", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://nextcloud.com/security/advisory/?id=nc-sa-2017-008", "name" : "https://nextcloud.com/security/advisory/?id=nc-sa-2017-008", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are vulnerable to an inadequate escaping of error messages leading to XSS vulnerabilities in multiple components." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*", "versionEndExcluding" : "9.0.58" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*", "versionStartIncluding" : "10.0.0", "versionEndExcluding" : "10.0.5" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*", "versionStartIncluding" : "11.0.0", "versionEndExcluding" : "11.0.3" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "REQUIRED", "scope" : "CHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 5.4, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.3, "impactScore" : 2.7 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:S/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 3.5 }, "severity" : "LOW", "exploitabilityScore" : 6.8, "impactScore" : 2.9, "acInsufInfo" : false, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-08T20:29Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0892", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nextcloud", "product" : { "product_data" : [ { "product_name" : "nextcloud", "version" : { "version_data" : [ { "version_value" : "11.0.2", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-384" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://hackerone.com/reports/191979", "name" : "https://hackerone.com/reports/191979", "refsource" : "MISC", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://nextcloud.com/security/advisory/?id=nc-sa-2017-009", "name" : "https://nextcloud.com/security/advisory/?id=nc-sa-2017-009", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Nextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an application specific password without permission to the files access to the users file." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*", "versionEndIncluding" : "11.0.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 3.5, "baseSeverity" : "LOW" }, "exploitabilityScore" : 2.1, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-08T20:29Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0893", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nextcloud", "product" : { "product_data" : [ { "product_name" : "nextcloud_server", "version" : { "version_data" : [ { "version_value" : "1.0", "version_affected" : "=" }, { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.1", "version_affected" : "=" }, { "version_value" : "2.0", "version_affected" : "=" }, { "version_value" : "3.0", "version_affected" : "=" }, { "version_value" : "3.0.1", "version_affected" : "=" }, { "version_value" : "4.0.0", "version_affected" : "=" }, { "version_value" : "4.0.1", "version_affected" : "=" }, { "version_value" : "4.0.2", "version_affected" : "=" }, { "version_value" : "4.0.3", "version_affected" : "=" }, { "version_value" : "4.0.4", "version_affected" : "=" }, { "version_value" : "4.0.5", "version_affected" : "=" }, { "version_value" : "4.0.6", "version_affected" : "=" }, { "version_value" : "4.0.7", "version_affected" : "=" }, { "version_value" : "4.0.8", "version_affected" : "=" }, { "version_value" : "4.0.9", "version_affected" : "=" }, { "version_value" : "4.0.10", "version_affected" : "=" }, { "version_value" : "4.0.11", "version_affected" : "=" }, { "version_value" : "4.0.12", "version_affected" : "=" }, { "version_value" : "4.0.13", "version_affected" : "=" }, { "version_value" : "4.0.14", "version_affected" : "=" }, { "version_value" : "4.0.15", "version_affected" : "=" }, { "version_value" : "4.0.16", "version_affected" : "=" }, { "version_value" : "4.5.0", "version_affected" : "=" }, { "version_value" : "4.5.1", "version_affected" : "=" }, { "version_value" : "4.5.2", "version_affected" : "=" }, { "version_value" : "4.5.3", "version_affected" : "=" }, { "version_value" : "4.5.4", "version_affected" : "=" }, { "version_value" : "4.5.5", "version_affected" : "=" }, { "version_value" : "4.5.6", "version_affected" : "=" }, { "version_value" : "4.5.7", "version_affected" : "=" }, { "version_value" : "4.5.8", "version_affected" : "=" }, { "version_value" : "4.5.9", "version_affected" : "=" }, { "version_value" : "4.5.10", "version_affected" : "=" }, { "version_value" : "4.5.11", "version_affected" : "=" }, { "version_value" : "4.5.12", "version_affected" : "=" }, { "version_value" : "4.5.13", "version_affected" : "=" }, { "version_value" : "5.0.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.0.2", "version_affected" : "=" }, { "version_value" : "5.0.3", "version_affected" : "=" }, { "version_value" : "5.0.4", "version_affected" : "=" }, { "version_value" : "5.0.5", "version_affected" : "=" }, { "version_value" : "5.0.6", "version_affected" : "=" }, { "version_value" : "5.0.7", "version_affected" : "=" }, { "version_value" : "5.0.8", "version_affected" : "=" }, { "version_value" : "5.0.9", "version_affected" : "=" }, { "version_value" : "5.0.10", "version_affected" : "=" }, { "version_value" : "5.0.11", "version_affected" : "=" }, { "version_value" : "5.0.12", "version_affected" : "=" }, { "version_value" : "5.0.13", "version_affected" : "=" }, { "version_value" : "5.0.14", "version_affected" : "=" }, { "version_value" : "5.0.15", "version_affected" : "=" }, { "version_value" : "5.0.16", "version_affected" : "=" }, { "version_value" : "5.0.17", "version_affected" : "=" }, { "version_value" : "5.0.19", "version_affected" : "=" }, { "version_value" : "6.0.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "6.0.2", "version_affected" : "=" }, { "version_value" : "6.0.3", "version_affected" : "=" }, { "version_value" : "6.0.4", "version_affected" : "=" }, { "version_value" : "6.0.5", "version_affected" : "=" }, { "version_value" : "6.0.6", "version_affected" : "=" }, { "version_value" : "6.0.7", "version_affected" : "=" }, { "version_value" : "6.0.8", "version_affected" : "=" }, { "version_value" : "6.0.9", "version_affected" : "=" }, { "version_value" : "6.0.10", "version_affected" : "=" }, { "version_value" : "7.0.0", "version_affected" : "=" }, { "version_value" : "7.0.1", "version_affected" : "=" }, { "version_value" : "7.0.2", "version_affected" : "=" }, { "version_value" : "7.0.3", "version_affected" : "=" }, { "version_value" : "7.0.4", "version_affected" : "=" }, { "version_value" : "7.0.5", "version_affected" : "=" }, { "version_value" : "7.0.6", "version_affected" : "=" }, { "version_value" : "7.0.7", "version_affected" : "=" }, { "version_value" : "7.0.8", "version_affected" : "=" }, { "version_value" : "7.0.9", "version_affected" : "=" }, { "version_value" : "7.0.10", "version_affected" : "=" }, { "version_value" : "7.0.11", "version_affected" : "=" }, { "version_value" : "7.0.12", "version_affected" : "=" }, { "version_value" : "7.0.13", "version_affected" : "=" }, { "version_value" : "7.0.14", "version_affected" : "=" }, { "version_value" : "7.0.15", "version_affected" : "=" }, { "version_value" : "8.0.0", "version_affected" : "=" }, { "version_value" : "8.0.1", "version_affected" : "=" }, { "version_value" : "8.0.2", "version_affected" : "=" }, { "version_value" : "8.0.3", "version_affected" : "=" }, { "version_value" : "8.0.4", "version_affected" : "=" }, { "version_value" : "8.0.5", "version_affected" : "=" }, { "version_value" : "8.0.6", "version_affected" : "=" }, { "version_value" : "8.0.7", "version_affected" : "=" }, { "version_value" : "8.0.8", "version_affected" : "=" }, { "version_value" : "8.0.9", "version_affected" : "=" }, { "version_value" : "8.0.10", "version_affected" : "=" }, { "version_value" : "8.0.11", "version_affected" : "=" }, { "version_value" : "8.0.12", "version_affected" : "=" }, { "version_value" : "8.0.13", "version_affected" : "=" }, { "version_value" : "8.0.14", "version_affected" : "=" }, { "version_value" : "8.0.15", "version_affected" : "=" }, { "version_value" : "8.0.16", "version_affected" : "=" }, { "version_value" : "8.1", "version_affected" : "=" }, { "version_value" : "8.1.0", "version_affected" : "=" }, { "version_value" : "8.1.1", "version_affected" : "=" }, { "version_value" : "8.1.2", "version_affected" : "=" }, { "version_value" : "8.1.3", "version_affected" : "=" }, { "version_value" : "8.1.4", "version_affected" : "=" }, { "version_value" : "8.1.5", "version_affected" : "=" }, { "version_value" : "8.1.6", "version_affected" : "=" }, { "version_value" : "8.1.7", "version_affected" : "=" }, { "version_value" : "8.1.8", "version_affected" : "=" }, { "version_value" : "8.1.9", "version_affected" : "=" }, { "version_value" : "8.1.10", "version_affected" : "=" }, { "version_value" : "8.1.11", "version_affected" : "=" }, { "version_value" : "8.2", "version_affected" : "=" }, { "version_value" : "8.2.0", "version_affected" : "=" }, { "version_value" : "8.2.1", "version_affected" : "=" }, { "version_value" : "8.2.2", "version_affected" : "=" }, { "version_value" : "8.2.3", "version_affected" : "=" }, { "version_value" : "8.2.4", "version_affected" : "=" }, { "version_value" : "8.2.5", "version_affected" : "=" }, { "version_value" : "8.2.6", "version_affected" : "=" }, { "version_value" : "8.2.7", "version_affected" : "=" }, { "version_value" : "8.2.8", "version_affected" : "=" }, { "version_value" : "8.2.9", "version_affected" : "=" }, { "version_value" : "9.0", "version_affected" : "=" }, { "version_value" : "9.0.0", "version_affected" : "=" }, { "version_value" : "9.0.1", "version_affected" : "=" }, { "version_value" : "9.0.2", "version_affected" : "=" }, { "version_value" : "9.0.3", "version_affected" : "=" }, { "version_value" : "9.0.4", "version_affected" : "=" }, { "version_value" : "9.0.5", "version_affected" : "=" }, { "version_value" : "9.0.6", "version_affected" : "=" }, { "version_value" : "9.0.7", "version_affected" : "=" }, { "version_value" : "9.0.50", "version_affected" : "=" }, { "version_value" : "9.0.51", "version_affected" : "=" }, { "version_value" : "9.0.52", "version_affected" : "=" }, { "version_value" : "9.0.53", "version_affected" : "=" }, { "version_value" : "9.0.54", "version_affected" : "=" }, { "version_value" : "9.0.55", "version_affected" : "=" }, { "version_value" : "9.0.56", "version_affected" : "=" }, { "version_value" : "9.0.57", "version_affected" : "=" }, { "version_value" : "10.0.0", "version_affected" : "=" }, { "version_value" : "10.0.1", "version_affected" : "=" }, { "version_value" : "10.0.2", "version_affected" : "=" }, { "version_value" : "10.0.3", "version_affected" : "=" }, { "version_value" : "10.0.4", "version_affected" : "=" }, { "version_value" : "11.0.0", "version_affected" : "=" }, { "version_value" : "11.0.1", "version_affected" : "=" }, { "version_value" : "11.0.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-79" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://hackerone.com/reports/222838", "name" : "https://hackerone.com/reports/222838", "refsource" : "MISC", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://nextcloud.com/security/advisory/?id=nc-sa-2017-010", "name" : "https://nextcloud.com/security/advisory/?id=nc-sa-2017-010", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are shipping a vulnerable JavaScript library for sanitizing untrusted user-input which suffered from a XSS vulnerability caused by a behaviour change in Safari 10.1 and 10.2. Note that Nextcloud employs a strict Content-Security-Policy preventing exploitation of this XSS issue on modern web browsers." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*", "versionEndExcluding" : "9.0.58" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*", "versionStartIncluding" : "10.0.0", "versionEndExcluding" : "10.0.5" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*", "versionStartIncluding" : "11.0.0", "versionEndExcluding" : "11.0.3" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "REQUIRED", "scope" : "CHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 5.4, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.3, "impactScore" : 2.7 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:S/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 3.5 }, "severity" : "LOW", "exploitabilityScore" : 6.8, "impactScore" : 2.9, "acInsufInfo" : false, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-08T20:29Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0894", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nextcloud", "product" : { "product_data" : [ { "product_name" : "nextcloud", "version" : { "version_data" : [ { "version_value" : "11.0.2", "version_affected" : "<=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://hackerone.com/reports/218876", "name" : "https://hackerone.com/reports/218876", "refsource" : "MISC", "tags" : [ "Permissions Required" ] }, { "url" : "https://nextcloud.com/security/advisory/?id=nc-sa-2017-011", "name" : "https://nextcloud.com/security/advisory/?id=nc-sa-2017-011", "refsource" : "CONFIRM", "tags" : [ "Patch", "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Nextcloud Server before 11.0.3 is vulnerable to disclosure of valid share tokens for public calendars due to a logical error. Thus granting an attacker potentially access to publicly shared calendars without knowing the share token." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nextcloud:nextcloud:*:*:*:*:*:*:*:*", "versionEndIncluding" : "11.0.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-08T20:29Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0895", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "nextcloud", "product" : { "product_data" : [ { "product_name" : "nextcloud_server", "version" : { "version_data" : [ { "version_value" : "10.0.0", "version_affected" : "=" }, { "version_value" : "10.0.1", "version_affected" : "=" }, { "version_value" : "10.0.2", "version_affected" : "=" }, { "version_value" : "10.0.3", "version_affected" : "=" }, { "version_value" : "11.0.0", "version_affected" : "=" }, { "version_value" : "11.0.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-200" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://hackerone.com/reports/203594", "name" : "https://hackerone.com/reports/203594", "refsource" : "MISC", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://nextcloud.com/security/advisory/?id=nc-sa-2017-012", "name" : "https://nextcloud.com/security/advisory/?id=nc-sa-2017-012", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note that no actual content of the calendar and addressbook has been disclosed." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*", "versionStartIncluding" : "10.0.0", "versionEndExcluding" : "10.0.4" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*", "versionStartIncluding" : "11.0.0", "versionEndExcluding" : "11.0.2" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "REQUIRED", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 3.5, "baseSeverity" : "LOW" }, "exploitabilityScore" : 2.1, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:S/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 3.5 }, "severity" : "LOW", "exploitabilityScore" : 6.8, "impactScore" : 2.9, "acInsufInfo" : false, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2017-05-08T20:29Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0896", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "zulip", "product" : { "product_data" : [ { "product_name" : "zulip_server", "version" : { "version_data" : [ { "version_value" : "1.3.0", "version_affected" : "=" }, { "version_value" : "1.3.1", "version_affected" : "=" }, { "version_value" : "1.3.2", "version_affected" : "=" }, { "version_value" : "1.3.3", "version_affected" : "=" }, { "version_value" : "1.3.4", "version_affected" : "=" }, { "version_value" : "1.3.6", "version_affected" : "=" }, { "version_value" : "1.3.7", "version_affected" : "=" }, { "version_value" : "1.3.8", "version_affected" : "=" }, { "version_value" : "1.3.9", "version_affected" : "=" }, { "version_value" : "1.3.10", "version_affected" : "=" }, { "version_value" : "1.3.11", "version_affected" : "=" }, { "version_value" : "1.3.12", "version_affected" : "=" }, { "version_value" : "1.3.13", "version_affected" : "=" }, { "version_value" : "1.4.0", "version_affected" : "=" }, { "version_value" : "1.4.1", "version_affected" : "=" }, { "version_value" : "1.4.2", "version_affected" : "=" }, { "version_value" : "1.4.3", "version_affected" : "=" }, { "version_value" : "1.5.0", "version_affected" : "=" }, { "version_value" : "1.5.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-862" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761b", "name" : "https://github.com/zulip/zulip/commit/1f48fa27672170bba3b9a97384905bb04c18761b", "refsource" : "MISC", "tags" : [ "Issue Tracking", "Patch" ] }, { "url" : "https://groups.google.com/forum/#!msg/zulip-announce/sUYeJv-fFmg/2TU2TLmNAwAJ", "name" : "[zulip-announce] 20170601 Zulip Server 1.5.2 released", "refsource" : "MLIST", "tags" : [ ] }, { "url" : "https://hackerone.com/reports/224210", "name" : "https://hackerone.com/reports/224210", "refsource" : "MISC", "tags" : [ "Permissions Required" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat application server that allowed an authenticated user to invite other users to join a Zulip organization even if the organization was configured to prevent this." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:zulip:zulip_server:1.3.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:zulip:zulip_server:1.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:zulip:zulip_server:1.3.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:zulip:zulip_server:1.3.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:zulip:zulip_server:1.3.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:zulip:zulip_server:1.3.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:zulip:zulip_server:1.3.7:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:zulip:zulip_server:1.3.8:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:zulip:zulip_server:1.3.9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:zulip:zulip_server:1.3.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:zulip:zulip_server:1.3.11:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:zulip:zulip_server:1.3.12:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:zulip:zulip_server:1.3.13:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:zulip:zulip_server:1.4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:zulip:zulip_server:1.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:zulip:zulip_server:1.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:zulip:zulip_server:1.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:zulip:zulip_server:1.5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:zulip:zulip_server:1.5.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "availabilityImpact" : "NONE", "baseScore" : 6.5, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:S/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "SINGLE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-06-02T17:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0897", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "expressionengine", "product" : { "product_data" : [ { "product_name" : "expressionengine", "version" : { "version_data" : [ { "version_value" : "2.0.0", "version_affected" : "=" }, { "version_value" : "2.0.1", "version_affected" : "=" }, { "version_value" : "2.0.2", "version_affected" : "=" }, { "version_value" : "2.1.0", "version_affected" : "=" }, { "version_value" : "2.1.1", "version_affected" : "=" }, { "version_value" : "2.1.2", "version_affected" : "=" }, { "version_value" : "2.1.3", "version_affected" : "=" }, { "version_value" : "2.1.4", "version_affected" : "=" }, { "version_value" : "2.1.5", "version_affected" : "=" }, { "version_value" : "2.2.0", "version_affected" : "=" }, { "version_value" : "2.2.1", "version_affected" : "=" }, { "version_value" : "2.2.2", "version_affected" : "=" }, { "version_value" : "2.3.0", "version_affected" : "=" }, { "version_value" : "2.3.1", "version_affected" : "=" }, { "version_value" : "2.4.0", "version_affected" : "=" }, { "version_value" : "2.5.0", "version_affected" : "=" }, { "version_value" : "2.5.1", "version_affected" : "=" }, { "version_value" : "2.5.2", "version_affected" : "=" }, { "version_value" : "2.5.3", "version_affected" : "=" }, { "version_value" : "2.5.4", "version_affected" : "=" }, { "version_value" : "2.5.5", "version_affected" : "=" }, { "version_value" : "2.6.0", "version_affected" : "=" }, { "version_value" : "2.6.1", "version_affected" : "=" }, { "version_value" : "2.7.0", "version_affected" : "=" }, { "version_value" : "2.7.1", "version_affected" : "=" }, { "version_value" : "2.7.2", "version_affected" : "=" }, { "version_value" : "2.7.3", "version_affected" : "=" }, { "version_value" : "2.8.0", "version_affected" : "=" }, { "version_value" : "2.8.1", "version_affected" : "=" }, { "version_value" : "2.9.0", "version_affected" : "=" }, { "version_value" : "2.9.1", "version_affected" : "=" }, { "version_value" : "2.9.2", "version_affected" : "=" }, { "version_value" : "2.9.3", "version_affected" : "=" }, { "version_value" : "2.10.0", "version_affected" : "=" }, { "version_value" : "2.10.1", "version_affected" : "=" }, { "version_value" : "2.10.2", "version_affected" : "=" }, { "version_value" : "2.10.3", "version_affected" : "=" }, { "version_value" : "2.11.0", "version_affected" : "=" }, { "version_value" : "2.11.1", "version_affected" : "=" }, { "version_value" : "2.11.2", "version_affected" : "=" }, { "version_value" : "2.11.3", "version_affected" : "=" }, { "version_value" : "2.11.4", "version_affected" : "=" }, { "version_value" : "2.11.5", "version_affected" : "=" }, { "version_value" : "2.11.6", "version_affected" : "=" }, { "version_value" : "2.11.7", "version_affected" : "=" }, { "version_value" : "3.0.0", "version_affected" : "=" }, { "version_value" : "3.0.1", "version_affected" : "=" }, { "version_value" : "3.0.2", "version_affected" : "=" }, { "version_value" : "3.0.3", "version_affected" : "=" }, { "version_value" : "3.0.4", "version_affected" : "=" }, { "version_value" : "3.0.5", "version_affected" : "=" }, { "version_value" : "3.0.6", "version_affected" : "=" }, { "version_value" : "3.1.0", "version_affected" : "=" }, { "version_value" : "3.1.1", "version_affected" : "=" }, { "version_value" : "3.1.2", "version_affected" : "=" }, { "version_value" : "3.1.3", "version_affected" : "=" }, { "version_value" : "3.1.4", "version_affected" : "=" }, { "version_value" : "3.2.0", "version_affected" : "=" }, { "version_value" : "3.2.1", "version_affected" : "=" }, { "version_value" : "3.3.0", "version_affected" : "=" }, { "version_value" : "3.3.1", "version_affected" : "=" }, { "version_value" : "3.3.2", "version_affected" : "=" }, { "version_value" : "3.3.3", "version_affected" : "=" }, { "version_value" : "3.3.4", "version_affected" : "=" }, { "version_value" : "3.4.0", "version_affected" : "=" }, { "version_value" : "3.4.1", "version_affected" : "=" }, { "version_value" : "3.4.2", "version_affected" : "=" }, { "version_value" : "3.4.3", "version_affected" : "=" }, { "version_value" : "3.4.4", "version_affected" : "=" }, { "version_value" : "3.4.5", "version_affected" : "=" }, { "version_value" : "3.4.6", "version_affected" : "=" }, { "version_value" : "3.4.7", "version_affected" : "=" }, { "version_value" : "3.5.0", "version_affected" : "=" }, { "version_value" : "3.5.1", "version_affected" : "=" }, { "version_value" : "3.5.2", "version_affected" : "=" }, { "version_value" : "3.5.3", "version_affected" : "=" }, { "version_value" : "3.5.4", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-331" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/99242", "name" : "99242", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://docs.expressionengine.com/latest/about/changelog.html#version-3-5-5", "name" : "https://docs.expressionengine.com/latest/about/changelog.html#version-3-5-5", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://docs.expressionengine.com/v2/about/changelog.html#version-2-11-8", "name" : "https://docs.expressionengine.com/v2/about/changelog.html#version-2-11-8", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://expressionengine.com/blog/expressionengine-3.5.5-and-2.11.8-released", "name" : "https://expressionengine.com/blog/expressionengine-3.5.5-and-2.11.8-released", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://hackerone.com/reports/215890", "name" : "https://hackerone.com/reports/215890", "refsource" : "MISC", "tags" : [ "Permissions Required" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "ExpressionEngine version 2.x < 2.11.8 and version 3.x < 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.0.0:public_beta:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.0.1:public_beta:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.0.2:public_beta:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.1.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.1.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.1.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.2.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.3.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.5.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.5.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.5.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.5.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.6.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.7.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.7.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.7.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.8.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.8.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.9.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.9.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.9.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.9.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.10.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.10.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.10.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.10.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.11.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.11.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.11.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.11.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.11.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.11.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.11.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:2.11.7:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.0.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.0.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.0.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.1.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.1.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.2.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.3.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.3.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.3.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.3.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.4.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.4.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.4.7:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.5.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.5.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:expressionengine:expressionengine:3.5.4:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-06-22T21:29Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0898", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "ruby-lang", "product" : { "product_data" : [ { "product_name" : "ruby", "version" : { "version_data" : [ { "version_value" : "2.2.0", "version_affected" : "=" }, { "version_value" : "2.2.1", "version_affected" : "=" }, { "version_value" : "2.2.2", "version_affected" : "=" }, { "version_value" : "2.2.3", "version_affected" : "=" }, { "version_value" : "2.2.4", "version_affected" : "=" }, { "version_value" : "2.2.5", "version_affected" : "=" }, { "version_value" : "2.2.6", "version_affected" : "=" }, { "version_value" : "2.2.7", "version_affected" : "=" }, { "version_value" : "2.3.0", "version_affected" : "=" }, { "version_value" : "2.3.1", "version_affected" : "=" }, { "version_value" : "2.3.2", "version_affected" : "=" }, { "version_value" : "2.3.3", "version_affected" : "=" }, { "version_value" : "2.3.4", "version_affected" : "=" }, { "version_value" : "2.4.0", "version_affected" : "=" }, { "version_value" : "2.4.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-134" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://www.securityfocus.com/bid/100862", "name" : "100862", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1039363", "name" : "1039363", "refsource" : "SECTRACK", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://access.redhat.com/errata/RHSA-2017:3485", "name" : "RHSA-2017:3485", "refsource" : "REDHAT", "tags" : [ ] }, { "url" : "https://access.redhat.com/errata/RHSA-2018:0378", "name" : "RHSA-2018:0378", "refsource" : "REDHAT", "tags" : [ ] }, { "url" : "https://access.redhat.com/errata/RHSA-2018:0583", "name" : "RHSA-2018:0583", "refsource" : "REDHAT", "tags" : [ ] }, { "url" : "https://access.redhat.com/errata/RHSA-2018:0585", "name" : "RHSA-2018:0585", "refsource" : "REDHAT", "tags" : [ ] }, { "url" : "https://github.com/mruby/mruby/issues/3722", "name" : "https://github.com/mruby/mruby/issues/3722", "refsource" : "MISC", "tags" : [ "Exploit", "Third Party Advisory" ] }, { "url" : "https://hackerone.com/reports/212241", "name" : "https://hackerone.com/reports/212241", "refsource" : "MISC", "tags" : [ "Exploit", "Third Party Advisory" ] }, { "url" : "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html", "name" : "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update", "refsource" : "MLIST", "tags" : [ ] }, { "url" : "https://security.gentoo.org/glsa/201710-18", "name" : "GLSA-201710-18", "refsource" : "GENTOO", "tags" : [ ] }, { "url" : "https://usn.ubuntu.com/3685-1/", "name" : "USN-3685-1", "refsource" : "UBUNTU", "tags" : [ ] }, { "url" : "https://www.debian.org/security/2017/dsa-4031", "name" : "DSA-4031", "refsource" : "DEBIAN", "tags" : [ ] }, { "url" : "https://www.ruby-lang.org/en/news/2017/09/14/sprintf-buffer-underrun-cve-2017-0898/", "name" : "https://www.ruby-lang.org/en/news/2017/09/14/sprintf-buffer-underrun-cve-2017-0898/", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus value. Such situation can lead to a buffer overrun, resulting in a heap memory corruption or an information disclosure from the heap." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:ruby-lang:ruby:2.2.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:ruby-lang:ruby:2.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:ruby-lang:ruby:2.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:ruby-lang:ruby:2.2.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:ruby-lang:ruby:2.2.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:ruby-lang:ruby:2.2.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:ruby-lang:ruby:2.2.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:ruby-lang:ruby:2.2.7:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:ruby-lang:ruby:2.3.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:ruby-lang:ruby:2.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:ruby-lang:ruby:2.3.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:ruby-lang:ruby:2.3.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:ruby-lang:ruby:2.3.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:ruby-lang:ruby:2.4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:ruby-lang:ruby:2.4.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 9.1, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 3.9, "impactScore" : 5.2 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 6.4 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 4.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-09-15T19:29Z", "lastModifiedDate" : "2018-07-15T01:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0899", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "rubygems", "product" : { "product_data" : [ { "product_name" : "rubygems", "version" : { "version_data" : [ { "version_value" : "2.6.12", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "debian", "product" : { "product_data" : [ { "product_name" : "debian_linux", "version" : { "version_data" : [ { "version_value" : "8.0", "version_affected" : "=" }, { "version_value" : "9.0", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "redhat", "product" : { "product_data" : [ { "product_name" : "enterprise_linux_desktop", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" } ] } }, { "product_name" : "enterprise_linux_server", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" } ] } }, { "product_name" : "enterprise_linux_server_aus", "version" : { "version_data" : [ { "version_value" : "7.4", "version_affected" : "=" }, { "version_value" : "7.6", "version_affected" : "=" } ] } }, { "product_name" : "enterprise_linux_server_eus", "version" : { "version_data" : [ { "version_value" : "7.4", "version_affected" : "=" }, { "version_value" : "7.5", "version_affected" : "=" }, { "version_value" : "7.6", "version_affected" : "=" } ] } }, { "product_name" : "enterprise_linux_server_tus", "version" : { "version_data" : [ { "version_value" : "7.4", "version_affected" : "=" }, { "version_value" : "7.6", "version_affected" : "=" } ] } }, { "product_name" : "enterprise_linux_workstation", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-94" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://blog.rubygems.org/2017/08/27/2.6.13-released.html", "name" : "http://blog.rubygems.org/2017/08/27/2.6.13-released.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "http://www.securityfocus.com/bid/100576", "name" : "100576", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1039249", "name" : "1039249", "refsource" : "SECTRACK", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://access.redhat.com/errata/RHSA-2017:3485", "name" : "RHSA-2017:3485", "refsource" : "REDHAT", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://access.redhat.com/errata/RHSA-2018:0378", "name" : "RHSA-2018:0378", "refsource" : "REDHAT", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://access.redhat.com/errata/RHSA-2018:0583", "name" : "RHSA-2018:0583", "refsource" : "REDHAT", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://access.redhat.com/errata/RHSA-2018:0585", "name" : "RHSA-2018:0585", "refsource" : "REDHAT", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://github.com/rubygems/rubygems/commit/1bcbc7fe637b03145401ec9c094066285934a7f1", "name" : "https://github.com/rubygems/rubygems/commit/1bcbc7fe637b03145401ec9c094066285934a7f1", "refsource" : "MISC", "tags" : [ "Patch", "Third Party Advisory" ] }, { "url" : "https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54d40c7fba6e8235eb43c5a491", "name" : "https://github.com/rubygems/rubygems/commit/ef0aa611effb5f54d40c7fba6e8235eb43c5a491", "refsource" : "MISC", "tags" : [ "Patch", "Third Party Advisory" ] }, { "url" : "https://hackerone.com/reports/226335", "name" : "https://hackerone.com/reports/226335", "refsource" : "MISC", "tags" : [ "Exploit", "Patch", "Third Party Advisory" ] }, { "url" : "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html", "name" : "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update", "refsource" : "MLIST", "tags" : [ "Mailing List", "Third Party Advisory" ] }, { "url" : "https://security.gentoo.org/glsa/201710-01", "name" : "GLSA-201710-01", "refsource" : "GENTOO", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://www.debian.org/security/2017/dsa-3966", "name" : "DSA-3966", "refsource" : "DEBIAN", "tags" : [ "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*", "versionEndIncluding" : "2.6.12" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 9.8, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 3.9, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 7.5 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.4, "acInsufInfo" : false, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-08-31T20:29Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0900", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "rubygems", "product" : { "product_data" : [ { "product_name" : "rubygems", "version" : { "version_data" : [ { "version_value" : "2.6.12", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "debian", "product" : { "product_data" : [ { "product_name" : "debian_linux", "version" : { "version_data" : [ { "version_value" : "8.0", "version_affected" : "=" }, { "version_value" : "9.0", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "redhat", "product" : { "product_data" : [ { "product_name" : "enterprise_linux_desktop", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" } ] } }, { "product_name" : "enterprise_linux_server", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" } ] } }, { "product_name" : "enterprise_linux_server_aus", "version" : { "version_data" : [ { "version_value" : "7.4", "version_affected" : "=" }, { "version_value" : "7.6", "version_affected" : "=" } ] } }, { "product_name" : "enterprise_linux_server_eus", "version" : { "version_data" : [ { "version_value" : "7.4", "version_affected" : "=" }, { "version_value" : "7.5", "version_affected" : "=" }, { "version_value" : "7.6", "version_affected" : "=" } ] } }, { "product_name" : "enterprise_linux_server_tus", "version" : { "version_data" : [ { "version_value" : "7.4", "version_affected" : "=" }, { "version_value" : "7.6", "version_affected" : "=" } ] } }, { "product_name" : "enterprise_linux_workstation", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://blog.rubygems.org/2017/08/27/2.6.13-released.html", "name" : "http://blog.rubygems.org/2017/08/27/2.6.13-released.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "http://www.securityfocus.com/bid/100579", "name" : "100579", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1039249", "name" : "1039249", "refsource" : "SECTRACK", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://access.redhat.com/errata/RHSA-2017:3485", "name" : "RHSA-2017:3485", "refsource" : "REDHAT", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://access.redhat.com/errata/RHSA-2018:0378", "name" : "RHSA-2018:0378", "refsource" : "REDHAT", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://access.redhat.com/errata/RHSA-2018:0583", "name" : "RHSA-2018:0583", "refsource" : "REDHAT", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://access.redhat.com/errata/RHSA-2018:0585", "name" : "RHSA-2018:0585", "refsource" : "REDHAT", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://github.com/rubygems/rubygems/commit/8a38a4fc24c6591e6c8f43d1fadab6efeb4d6251", "name" : "https://github.com/rubygems/rubygems/commit/8a38a4fc24c6591e6c8f43d1fadab6efeb4d6251", "refsource" : "MISC", "tags" : [ "Patch", "Third Party Advisory" ] }, { "url" : "https://hackerone.com/reports/243003", "name" : "https://hackerone.com/reports/243003", "refsource" : "MISC", "tags" : [ "Exploit", "Third Party Advisory" ] }, { "url" : "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html", "name" : "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update", "refsource" : "MLIST", "tags" : [ "Mailing List", "Third Party Advisory" ] }, { "url" : "https://security.gentoo.org/glsa/201710-01", "name" : "GLSA-201710-01", "refsource" : "GENTOO", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://www.debian.org/security/2017/dsa-3966", "name" : "DSA-3966", "refsource" : "DEBIAN", "tags" : [ "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a `query` command." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*", "versionEndIncluding" : "2.6.12" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "HIGH", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:N/I:N/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "NONE", "availabilityImpact" : "PARTIAL", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "acInsufInfo" : false, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-08-31T20:29Z", "lastModifiedDate" : "2019-05-13T14:31Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0901", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "rubygems", "product" : { "product_data" : [ { "product_name" : "rubygems", "version" : { "version_data" : [ { "version_value" : "2.6.12", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "canonical", "product" : { "product_data" : [ { "product_name" : "ubuntu_linux", "version" : { "version_data" : [ { "version_value" : "14.04", "version_affected" : "=" }, { "version_value" : "16.04", "version_affected" : "=" }, { "version_value" : "17.10", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "debian", "product" : { "product_data" : [ { "product_name" : "debian_linux", "version" : { "version_data" : [ { "version_value" : "8.0", "version_affected" : "=" }, { "version_value" : "9.0", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "redhat", "product" : { "product_data" : [ { "product_name" : "enterprise_linux_desktop", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" } ] } }, { "product_name" : "enterprise_linux_server", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" } ] } }, { "product_name" : "enterprise_linux_server_aus", "version" : { "version_data" : [ { "version_value" : "7.4", "version_affected" : "=" }, { "version_value" : "7.6", "version_affected" : "=" } ] } }, { "product_name" : "enterprise_linux_server_eus", "version" : { "version_data" : [ { "version_value" : "7.4", "version_affected" : "=" }, { "version_value" : "7.5", "version_affected" : "=" }, { "version_value" : "7.6", "version_affected" : "=" } ] } }, { "product_name" : "enterprise_linux_server_tus", "version" : { "version_data" : [ { "version_value" : "7.4", "version_affected" : "=" }, { "version_value" : "7.6", "version_affected" : "=" } ] } }, { "product_name" : "enterprise_linux_workstation", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://blog.rubygems.org/2017/08/27/2.6.13-released.html", "name" : "http://blog.rubygems.org/2017/08/27/2.6.13-released.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "http://www.securityfocus.com/bid/100580", "name" : "100580", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1039249", "name" : "1039249", "refsource" : "SECTRACK", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://access.redhat.com/errata/RHSA-2017:3485", "name" : "RHSA-2017:3485", "refsource" : "REDHAT", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://access.redhat.com/errata/RHSA-2018:0378", "name" : "RHSA-2018:0378", "refsource" : "REDHAT", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://access.redhat.com/errata/RHSA-2018:0583", "name" : "RHSA-2018:0583", "refsource" : "REDHAT", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://access.redhat.com/errata/RHSA-2018:0585", "name" : "RHSA-2018:0585", "refsource" : "REDHAT", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://github.com/rubygems/rubygems/commit/ad5c0a53a86ca5b218c7976765c0365b91d22cb2", "name" : "https://github.com/rubygems/rubygems/commit/ad5c0a53a86ca5b218c7976765c0365b91d22cb2", "refsource" : "MISC", "tags" : [ "Patch", "Third Party Advisory" ] }, { "url" : "https://hackerone.com/reports/243156", "name" : "https://hackerone.com/reports/243156", "refsource" : "MISC", "tags" : [ "Exploit", "Patch", "Third Party Advisory" ] }, { "url" : "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html", "name" : "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update", "refsource" : "MLIST", "tags" : [ "Mailing List", "Third Party Advisory" ] }, { "url" : "https://security.gentoo.org/glsa/201710-01", "name" : "GLSA-201710-01", "refsource" : "GENTOO", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://usn.ubuntu.com/3553-1/", "name" : "USN-3553-1", "refsource" : "UBUNTU", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://usn.ubuntu.com/3685-1/", "name" : "USN-3685-1", "refsource" : "UBUNTU", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://www.debian.org/security/2017/dsa-3966", "name" : "DSA-3966", "refsource" : "DEBIAN", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://www.exploit-db.com/exploits/42611/", "name" : "42611", "refsource" : "EXPLOIT-DB", "tags" : [ "Exploit", "Third Party Advisory", "VDB Entry" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*", "versionEndIncluding" : "2.6.12" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "availabilityImpact" : "NONE", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:N/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.4 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 4.9, "acInsufInfo" : false, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-08-31T20:29Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0902", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "rubygems", "product" : { "product_data" : [ { "product_name" : "rubygems", "version" : { "version_data" : [ { "version_value" : "2.6.12", "version_affected" : "<=" } ] } } ] } }, { "vendor_name" : "canonical", "product" : { "product_data" : [ { "product_name" : "ubuntu_linux", "version" : { "version_data" : [ { "version_value" : "14.04", "version_affected" : "=" }, { "version_value" : "16.04", "version_affected" : "=" }, { "version_value" : "17.10", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "debian", "product" : { "product_data" : [ { "product_name" : "debian_linux", "version" : { "version_data" : [ { "version_value" : "8.0", "version_affected" : "=" }, { "version_value" : "9.0", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "redhat", "product" : { "product_data" : [ { "product_name" : "enterprise_linux_desktop", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" } ] } }, { "product_name" : "enterprise_linux_server", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" } ] } }, { "product_name" : "enterprise_linux_server_aus", "version" : { "version_data" : [ { "version_value" : "7.4", "version_affected" : "=" }, { "version_value" : "7.6", "version_affected" : "=" } ] } }, { "product_name" : "enterprise_linux_server_eus", "version" : { "version_data" : [ { "version_value" : "7.4", "version_affected" : "=" }, { "version_value" : "7.5", "version_affected" : "=" }, { "version_value" : "7.6", "version_affected" : "=" } ] } }, { "product_name" : "enterprise_linux_server_tus", "version" : { "version_data" : [ { "version_value" : "7.4", "version_affected" : "=" }, { "version_value" : "7.6", "version_affected" : "=" } ] } }, { "product_name" : "enterprise_linux_workstation", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-346" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://blog.rubygems.org/2017/08/27/2.6.13-released.html", "name" : "http://blog.rubygems.org/2017/08/27/2.6.13-released.html", "refsource" : "MISC", "tags" : [ "Patch", "Vendor Advisory" ] }, { "url" : "http://www.securityfocus.com/bid/100586", "name" : "100586", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "http://www.securitytracker.com/id/1039249", "name" : "1039249", "refsource" : "SECTRACK", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://access.redhat.com/errata/RHSA-2017:3485", "name" : "RHSA-2017:3485", "refsource" : "REDHAT", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://access.redhat.com/errata/RHSA-2018:0378", "name" : "RHSA-2018:0378", "refsource" : "REDHAT", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://access.redhat.com/errata/RHSA-2018:0583", "name" : "RHSA-2018:0583", "refsource" : "REDHAT", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://access.redhat.com/errata/RHSA-2018:0585", "name" : "RHSA-2018:0585", "refsource" : "REDHAT", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://github.com/rubygems/rubygems/commit/8d91516fb7037ecfb27622f605dc40245e0f8d32", "name" : "https://github.com/rubygems/rubygems/commit/8d91516fb7037ecfb27622f605dc40245e0f8d32", "refsource" : "MISC", "tags" : [ "Exploit", "Patch", "Third Party Advisory" ] }, { "url" : "https://hackerone.com/reports/218088", "name" : "https://hackerone.com/reports/218088", "refsource" : "MISC", "tags" : [ "Exploit", "Issue Tracking", "Third Party Advisory" ] }, { "url" : "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html", "name" : "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update", "refsource" : "MLIST", "tags" : [ "Mailing List", "Third Party Advisory" ] }, { "url" : "https://security.gentoo.org/glsa/201710-01", "name" : "GLSA-201710-01", "refsource" : "GENTOO", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://usn.ubuntu.com/3553-1/", "name" : "USN-3553-1", "refsource" : "UBUNTU", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://usn.ubuntu.com/3685-1/", "name" : "USN-3685-1", "refsource" : "UBUNTU", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://www.debian.org/security/2017/dsa-3966", "name" : "DSA-3966", "refsource" : "DEBIAN", "tags" : [ "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:*:*:*:*:*:*:*:*", "versionEndIncluding" : "2.6.12" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.1, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.2, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "acInsufInfo" : false, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-08-31T20:29Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0903", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "rubygems", "product" : { "product_data" : [ { "product_name" : "rubygems", "version" : { "version_data" : [ { "version_value" : "2.0.0", "version_affected" : "=" }, { "version_value" : "2.0.1", "version_affected" : "=" }, { "version_value" : "2.0.2", "version_affected" : "=" }, { "version_value" : "2.0.3", "version_affected" : "=" }, { "version_value" : "2.0.4", "version_affected" : "=" }, { "version_value" : "2.0.5", "version_affected" : "=" }, { "version_value" : "2.0.6", "version_affected" : "=" }, { "version_value" : "2.0.7", "version_affected" : "=" }, { "version_value" : "2.0.8", "version_affected" : "=" }, { "version_value" : "2.0.9", "version_affected" : "=" }, { "version_value" : "2.0.10", "version_affected" : "=" }, { "version_value" : "2.0.11", "version_affected" : "=" }, { "version_value" : "2.0.12", "version_affected" : "=" }, { "version_value" : "2.0.13", "version_affected" : "=" }, { "version_value" : "2.0.14", "version_affected" : "=" }, { "version_value" : "2.0.15", "version_affected" : "=" }, { "version_value" : "2.0.16", "version_affected" : "=" }, { "version_value" : "2.0.17", "version_affected" : "=" }, { "version_value" : "2.1.0", "version_affected" : "=" }, { "version_value" : "2.1.0.rc.1", "version_affected" : "=" }, { "version_value" : "2.1.0.rc.2", "version_affected" : "=" }, { "version_value" : "2.1.1", "version_affected" : "=" }, { "version_value" : "2.1.2", "version_affected" : "=" }, { "version_value" : "2.1.3", "version_affected" : "=" }, { "version_value" : "2.1.4", "version_affected" : "=" }, { "version_value" : "2.1.5", "version_affected" : "=" }, { "version_value" : "2.1.6", "version_affected" : "=" }, { "version_value" : "2.1.7", "version_affected" : "=" }, { "version_value" : "2.1.8", "version_affected" : "=" }, { "version_value" : "2.1.9", "version_affected" : "=" }, { "version_value" : "2.1.10", "version_affected" : "=" }, { "version_value" : "2.1.11", "version_affected" : "=" }, { "version_value" : "2.2.0", "version_affected" : "=" }, { "version_value" : "2.2.0.preiew.1", "version_affected" : "=" }, { "version_value" : "2.2.0.rc.1", "version_affected" : "=" }, { "version_value" : "2.2.1", "version_affected" : "=" }, { "version_value" : "2.2.2", "version_affected" : "=" }, { "version_value" : "2.2.3", "version_affected" : "=" }, { "version_value" : "2.2.4", "version_affected" : "=" }, { "version_value" : "2.2.5", "version_affected" : "=" }, { "version_value" : "2.3.0", "version_affected" : "=" }, { "version_value" : "2.4.0", "version_affected" : "=" }, { "version_value" : "2.4.1", "version_affected" : "=" }, { "version_value" : "2.4.2", "version_affected" : "=" }, { "version_value" : "2.4.3", "version_affected" : "=" }, { "version_value" : "2.4.4", "version_affected" : "=" }, { "version_value" : "2.4.5", "version_affected" : "=" }, { "version_value" : "2.4.6", "version_affected" : "=" }, { "version_value" : "2.4.7", "version_affected" : "=" }, { "version_value" : "2.4.8", "version_affected" : "=" }, { "version_value" : "2.5.0", "version_affected" : "=" }, { "version_value" : "2.5.1", "version_affected" : "=" }, { "version_value" : "2.5.2", "version_affected" : "=" }, { "version_value" : "2.6.0", "version_affected" : "=" }, { "version_value" : "2.6.1", "version_affected" : "=" }, { "version_value" : "2.6.2", "version_affected" : "=" }, { "version_value" : "2.6.3", "version_affected" : "=" }, { "version_value" : "2.6.4", "version_affected" : "=" }, { "version_value" : "2.6.5", "version_affected" : "=" }, { "version_value" : "2.6.6", "version_affected" : "=" }, { "version_value" : "2.6.7", "version_affected" : "=" }, { "version_value" : "2.6.8", "version_affected" : "=" }, { "version_value" : "2.6.9", "version_affected" : "=" }, { "version_value" : "2.6.10", "version_affected" : "=" }, { "version_value" : "2.6.11", "version_affected" : "=" }, { "version_value" : "2.6.12", "version_affected" : "=" }, { "version_value" : "2.6.13", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "canonical", "product" : { "product_data" : [ { "product_name" : "ubuntu_linux", "version" : { "version_data" : [ { "version_value" : "14.04", "version_affected" : "=" }, { "version_value" : "16.04", "version_affected" : "=" }, { "version_value" : "17.10", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "debian", "product" : { "product_data" : [ { "product_name" : "debian_linux", "version" : { "version_data" : [ { "version_value" : "8.0", "version_affected" : "=" }, { "version_value" : "9.0", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "redhat", "product" : { "product_data" : [ { "product_name" : "enterprise_linux_desktop", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" } ] } }, { "product_name" : "enterprise_linux_server", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" } ] } }, { "product_name" : "enterprise_linux_server_aus", "version" : { "version_data" : [ { "version_value" : "7.4", "version_affected" : "=" }, { "version_value" : "7.6", "version_affected" : "=" } ] } }, { "product_name" : "enterprise_linux_server_eus", "version" : { "version_data" : [ { "version_value" : "7.4", "version_affected" : "=" }, { "version_value" : "7.5", "version_affected" : "=" }, { "version_value" : "7.6", "version_affected" : "=" } ] } }, { "product_name" : "enterprise_linux_server_tus", "version" : { "version_data" : [ { "version_value" : "7.4", "version_affected" : "=" }, { "version_value" : "7.6", "version_affected" : "=" } ] } }, { "product_name" : "enterprise_linux_workstation", "version" : { "version_data" : [ { "version_value" : "7.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-502" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://blog.rubygems.org/2017/10/09/2.6.14-released.html", "name" : "http://blog.rubygems.org/2017/10/09/2.6.14-released.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] }, { "url" : "http://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html", "name" : "http://blog.rubygems.org/2017/10/09/unsafe-object-deserialization-vulnerability.html", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] }, { "url" : "http://www.securityfocus.com/bid/101275", "name" : "101275", "refsource" : "BID", "tags" : [ "Third Party Advisory", "VDB Entry" ] }, { "url" : "https://access.redhat.com/errata/RHSA-2017:3485", "name" : "RHSA-2017:3485", "refsource" : "REDHAT", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://access.redhat.com/errata/RHSA-2018:0378", "name" : "RHSA-2018:0378", "refsource" : "REDHAT", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://access.redhat.com/errata/RHSA-2018:0583", "name" : "RHSA-2018:0583", "refsource" : "REDHAT", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://access.redhat.com/errata/RHSA-2018:0585", "name" : "RHSA-2018:0585", "refsource" : "REDHAT", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://github.com/rubygems/rubygems/commit/510b1638ac9bba3ceb7a5d73135dafff9e5bab49", "name" : "https://github.com/rubygems/rubygems/commit/510b1638ac9bba3ceb7a5d73135dafff9e5bab49", "refsource" : "MISC", "tags" : [ "Patch", "Third Party Advisory" ] }, { "url" : "https://hackerone.com/reports/274990", "name" : "https://hackerone.com/reports/274990", "refsource" : "MISC", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html", "name" : "[debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update", "refsource" : "MLIST", "tags" : [ "Mailing List", "Third Party Advisory" ] }, { "url" : "https://usn.ubuntu.com/3553-1/", "name" : "USN-3553-1", "refsource" : "UBUNTU", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://usn.ubuntu.com/3685-1/", "name" : "USN-3685-1", "refsource" : "UBUNTU", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://www.debian.org/security/2017/dsa-4031", "name" : "DSA-4031", "refsource" : "DEBIAN", "tags" : [ "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.0.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.0.0:preview2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.0.0:preview2.2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.0.0:rc1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.0.0:rc2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.0.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.0.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.0.7:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.0.8:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.0.9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.0.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.0.11:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.0.12:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.0.13:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.0.14:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.0.15:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.0.16:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.0.17:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.1.0.rc.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.1.0.rc.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.1.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.1.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.1.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.1.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.1.7:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.1.8:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.1.9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.1.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.1.11:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.2.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.2.0.preiew.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.2.0.rc.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.2.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.2.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.2.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.3.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.4.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.4.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.4.7:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.4.8:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.5.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.6.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.6.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.6.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.6.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.6.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.6.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.6.7:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.6.8:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.6.9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.6.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.6.11:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.6.12:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:rubygems:rubygems:2.6.13:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 9.8, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 3.9, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 7.5 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.4, "acInsufInfo" : false, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-10-11T18:29Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0904", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "private_address_check_project", "product" : { "product_data" : [ { "product_name" : "private_address_check", "version" : { "version_data" : [ { "version_value" : "0.1.0", "version_affected" : "=" }, { "version_value" : "0.2.0", "version_affected" : "=" }, { "version_value" : "0.3.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-755" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://edoverflow.com/2017/ruby-resolv-bug/", "name" : "https://edoverflow.com/2017/ruby-resolv-bug/", "refsource" : "MISC", "tags" : [ "Issue Tracking", "Third Party Advisory" ] }, { "url" : "https://github.com/jtdowney/private_address_check/commit/58a0d7fe31de339c0117160567a5b33ad82b46af", "name" : "https://github.com/jtdowney/private_address_check/commit/58a0d7fe31de339c0117160567a5b33ad82b46af", "refsource" : "CONFIRM", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://github.com/jtdowney/private_address_check/issues/1", "name" : "https://github.com/jtdowney/private_address_check/issues/1", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Third Party Advisory" ] }, { "url" : "https://hackerone.com/reports/287245", "name" : "https://hackerone.com/reports/287245", "refsource" : "MISC", "tags" : [ "Issue Tracking", "Mitigation", "Patch", "Third Party Advisory" ] }, { "url" : "https://hackerone.com/reports/287835", "name" : "https://hackerone.com/reports/287835", "refsource" : "MISC", "tags" : [ "Permissions Required", "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security measures, such as when used to blacklist private network addresses to prevent server-side request forgery." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:private_address_check_project:private_address_check:*:*:*:*:*:ruby:*:*", "versionEndExcluding" : "0.4.0" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "HIGH", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.1, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.2, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.8 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-13T17:29Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0905", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "recurly", "product" : { "product_data" : [ { "product_name" : "recurly_client_ruby", "version" : { "version_data" : [ { "version_value" : "2.0.0", "version_affected" : "=" }, { "version_value" : "2.0.1", "version_affected" : "=" }, { "version_value" : "2.0.2", "version_affected" : "=" }, { "version_value" : "2.0.3", "version_affected" : "=" }, { "version_value" : "2.0.4", "version_affected" : "=" }, { "version_value" : "2.0.5", "version_affected" : "=" }, { "version_value" : "2.0.6", "version_affected" : "=" }, { "version_value" : "2.0.7", "version_affected" : "=" }, { "version_value" : "2.0.8", "version_affected" : "=" }, { "version_value" : "2.0.9", "version_affected" : "=" }, { "version_value" : "2.0.10", "version_affected" : "=" }, { "version_value" : "2.0.11", "version_affected" : "=" }, { "version_value" : "2.0.12", "version_affected" : "=" }, { "version_value" : "2.1.0", "version_affected" : "=" }, { "version_value" : "2.1.1", "version_affected" : "=" }, { "version_value" : "2.1.2", "version_affected" : "=" }, { "version_value" : "2.1.3", "version_affected" : "=" }, { "version_value" : "2.1.4", "version_affected" : "=" }, { "version_value" : "2.1.5", "version_affected" : "=" }, { "version_value" : "2.1.6", "version_affected" : "=" }, { "version_value" : "2.1.7", "version_affected" : "=" }, { "version_value" : "2.1.8", "version_affected" : "=" }, { "version_value" : "2.1.9", "version_affected" : "=" }, { "version_value" : "2.1.10", "version_affected" : "=" }, { "version_value" : "2.2.0", "version_affected" : "=" }, { "version_value" : "2.2.1", "version_affected" : "=" }, { "version_value" : "2.2.2", "version_affected" : "=" }, { "version_value" : "2.2.3", "version_affected" : "=" }, { "version_value" : "2.2.4", "version_affected" : "=" }, { "version_value" : "2.3.0", "version_affected" : "=" }, { "version_value" : "2.3.1", "version_affected" : "=" }, { "version_value" : "2.3.2", "version_affected" : "=" }, { "version_value" : "2.3.3", "version_affected" : "=" }, { "version_value" : "2.3.4", "version_affected" : "=" }, { "version_value" : "2.3.5", "version_affected" : "=" }, { "version_value" : "2.3.6", "version_affected" : "=" }, { "version_value" : "2.3.7", "version_affected" : "=" }, { "version_value" : "2.3.8", "version_affected" : "=" }, { "version_value" : "2.3.9", "version_affected" : "=" }, { "version_value" : "2.4.0", "version_affected" : "=" }, { "version_value" : "2.4.1", "version_affected" : "=" }, { "version_value" : "2.4.2", "version_affected" : "=" }, { "version_value" : "2.4.3", "version_affected" : "=" }, { "version_value" : "2.4.4", "version_affected" : "=" }, { "version_value" : "2.4.5", "version_affected" : "=" }, { "version_value" : "2.4.6", "version_affected" : "=" }, { "version_value" : "2.4.7", "version_affected" : "=" }, { "version_value" : "2.4.8", "version_affected" : "=" }, { "version_value" : "2.4.9", "version_affected" : "=" }, { "version_value" : "2.4.10", "version_affected" : "=" }, { "version_value" : "2.5.0", "version_affected" : "=" }, { "version_value" : "2.5.1", "version_affected" : "=" }, { "version_value" : "2.5.2", "version_affected" : "=" }, { "version_value" : "2.5.3", "version_affected" : "=" }, { "version_value" : "2.6.0", "version_affected" : "=" }, { "version_value" : "2.6.1", "version_affected" : "=" }, { "version_value" : "2.6.2", "version_affected" : "=" }, { "version_value" : "2.7.0", "version_affected" : "=" }, { "version_value" : "2.7.1", "version_affected" : "=" }, { "version_value" : "2.7.2", "version_affected" : "=" }, { "version_value" : "2.7.3", "version_affected" : "=" }, { "version_value" : "2.7.4", "version_affected" : "=" }, { "version_value" : "2.7.5", "version_affected" : "=" }, { "version_value" : "2.7.6", "version_affected" : "=" }, { "version_value" : "2.7.7", "version_affected" : "=" }, { "version_value" : "2.8.0", "version_affected" : "=" }, { "version_value" : "2.8.1", "version_affected" : "=" }, { "version_value" : "2.9.0", "version_affected" : "=" }, { "version_value" : "2.9.1", "version_affected" : "=" }, { "version_value" : "2.10.0", "version_affected" : "=" }, { "version_value" : "2.10.1", "version_affected" : "=" }, { "version_value" : "2.10.2", "version_affected" : "=" }, { "version_value" : "2.10.3", "version_affected" : "=" }, { "version_value" : "2.11.0", "version_affected" : "=" }, { "version_value" : "2.11.1", "version_affected" : "=" }, { "version_value" : "2.11.2", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-918" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://dev.recurly.com/page/ruby-updates", "name" : "https://dev.recurly.com/page/ruby-updates", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://github.com/recurly/recurly-client-ruby/commit/1bb0284d6e668b8b3d31167790ed6db1f6ccc4be", "name" : "https://github.com/recurly/recurly-client-ruby/commit/1bb0284d6e668b8b3d31167790ed6db1f6ccc4be", "refsource" : "CONFIRM", "tags" : [ "Patch", "Third Party Advisory" ] }, { "url" : "https://hackerone.com/reports/288635", "name" : "https://hackerone.com/reports/288635", "refsource" : "MISC", "tags" : [ "Permissions Required" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the \"Resource#find\" method that could result in compromise of API keys or other critical resources." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.0.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.0.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.0.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.0.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.0.7:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.0.8:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.0.9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.0.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.0.11:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.0.12:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.1.0:c:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.1.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.1.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.1.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.1.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.1.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.1.7:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.1.8:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.1.9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.1.10:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.2.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.2.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.2.4:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.3.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.3.0:beta1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.3.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.3.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.3.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.3.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.3.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.3.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.3.7:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.3.8:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.3.9:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.4.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.4.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.4.7:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.4.8:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.4.9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.4.10:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.5.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.5.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.5.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.5.3:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.6.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.6.2:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.7.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.7.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.7.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.7.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.7.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.7.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.7.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.7.7:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.8.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.8.0:rc1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.8.0:rc3:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.8.1:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.9.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.9.1:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.10.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.10.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.10.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.10.3:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.11.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.11.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_ruby:2.11.2:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 9.8, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 3.9, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 7.5 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-13T17:29Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0906", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "recurly", "product" : { "product_data" : [ { "product_name" : "recurly_client_python", "version" : { "version_data" : [ { "version_value" : "2.0.0", "version_affected" : "=" }, { "version_value" : "2.0.1", "version_affected" : "=" }, { "version_value" : "2.0.2", "version_affected" : "=" }, { "version_value" : "2.0.3", "version_affected" : "=" }, { "version_value" : "2.0.4", "version_affected" : "=" }, { "version_value" : "2.1.0", "version_affected" : "=" }, { "version_value" : "2.1.1", "version_affected" : "=" }, { "version_value" : "2.1.2", "version_affected" : "=" }, { "version_value" : "2.1.3", "version_affected" : "=" }, { "version_value" : "2.1.4", "version_affected" : "=" }, { "version_value" : "2.1.12", "version_affected" : "=" }, { "version_value" : "2.1.13", "version_affected" : "=" }, { "version_value" : "2.1.14", "version_affected" : "=" }, { "version_value" : "2.1.15", "version_affected" : "=" }, { "version_value" : "2.2.0", "version_affected" : "=" }, { "version_value" : "2.2.1", "version_affected" : "=" }, { "version_value" : "2.2.2", "version_affected" : "=" }, { "version_value" : "2.2.3", "version_affected" : "=" }, { "version_value" : "2.2.4", "version_affected" : "=" }, { "version_value" : "2.2.6", "version_affected" : "=" }, { "version_value" : "2.2.7", "version_affected" : "=" }, { "version_value" : "2.2.8", "version_affected" : "=" }, { "version_value" : "2.2.9", "version_affected" : "=" }, { "version_value" : "2.2.10", "version_affected" : "=" }, { "version_value" : "2.2.11", "version_affected" : "=" }, { "version_value" : "2.2.12", "version_affected" : "=" }, { "version_value" : "2.2.13", "version_affected" : "=" }, { "version_value" : "2.2.14", "version_affected" : "=" }, { "version_value" : "2.2.15", "version_affected" : "=" }, { "version_value" : "2.2.16", "version_affected" : "=" }, { "version_value" : "2.2.17", "version_affected" : "=" }, { "version_value" : "2.2.18", "version_affected" : "=" }, { "version_value" : "2.2.19", "version_affected" : "=" }, { "version_value" : "2.2.20", "version_affected" : "=" }, { "version_value" : "2.2.21", "version_affected" : "=" }, { "version_value" : "2.3.0", "version_affected" : "=" }, { "version_value" : "2.4.0", "version_affected" : "=" }, { "version_value" : "2.4.1", "version_affected" : "=" }, { "version_value" : "2.4.2", "version_affected" : "=" }, { "version_value" : "2.4.3", "version_affected" : "=" }, { "version_value" : "2.4.4", "version_affected" : "=" }, { "version_value" : "2.5.0", "version_affected" : "=" }, { "version_value" : "2.6.0", "version_affected" : "=" }, { "version_value" : "2.6.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-918" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://dev.recurly.com/page/python-updates", "name" : "https://dev.recurly.com/page/python-updates", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://github.com/recurly/recurly-client-python/commit/049c74699ce93cf126feff06d632ea63fba36742", "name" : "https://github.com/recurly/recurly-client-python/commit/049c74699ce93cf126feff06d632ea63fba36742", "refsource" : "CONFIRM", "tags" : [ "Patch", "Third Party Advisory" ] }, { "url" : "https://hackerone.com/reports/288635", "name" : "https://hackerone.com/reports/288635", "refsource" : "MISC", "tags" : [ "Permissions Required" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the \"Resource.get\" method that could result in compromise of API keys or other critical resources." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_python:*:*:*:*:*:*:*:*", "versionStartIncluding" : "2.0.0", "versionEndIncluding" : "2.0.4" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_python:*:*:*:*:*:*:*:*", "versionStartIncluding" : "2.1.0", "versionEndIncluding" : "2.1.15" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_python:*:*:*:*:*:*:*:*", "versionStartIncluding" : "2.2.0", "versionEndIncluding" : "2.2.21" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_python:2.3.0:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_python:*:*:*:*:*:*:*:*", "versionStartIncluding" : "2.4.0", "versionEndIncluding" : "2.4.4" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_python:2.5.0:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_python:2.6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_python:2.6.1:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 9.8, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 3.9, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 7.5 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-13T17:29Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0907", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "recurly", "product" : { "product_data" : [ { "product_name" : "recurly_client_.net", "version" : { "version_data" : [ { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.0.1", "version_affected" : "=" }, { "version_value" : "1.0.0.2", "version_affected" : "=" }, { "version_value" : "1.0.0.3", "version_affected" : "=" }, { "version_value" : "1.0.0.4", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.1.1", "version_affected" : "=" }, { "version_value" : "1.1.4", "version_affected" : "=" }, { "version_value" : "1.1.5", "version_affected" : "=" }, { "version_value" : "1.1.6", "version_affected" : "=" }, { "version_value" : "1.1.7", "version_affected" : "=" }, { "version_value" : "1.1.8", "version_affected" : "=" }, { "version_value" : "1.1.9", "version_affected" : "=" }, { "version_value" : "1.2.0", "version_affected" : "=" }, { "version_value" : "1.2.1", "version_affected" : "=" }, { "version_value" : "1.2.2", "version_affected" : "=" }, { "version_value" : "1.2.5", "version_affected" : "=" }, { "version_value" : "1.2.6", "version_affected" : "=" }, { "version_value" : "1.2.7", "version_affected" : "=" }, { "version_value" : "1.3.0", "version_affected" : "=" }, { "version_value" : "1.3.1", "version_affected" : "=" }, { "version_value" : "1.4.0", "version_affected" : "=" }, { "version_value" : "1.4.1", "version_affected" : "=" }, { "version_value" : "1.4.2", "version_affected" : "=" }, { "version_value" : "1.4.3", "version_affected" : "=" }, { "version_value" : "1.4.4", "version_affected" : "=" }, { "version_value" : "1.4.5", "version_affected" : "=" }, { "version_value" : "1.4.6", "version_affected" : "=" }, { "version_value" : "1.4.7", "version_affected" : "=" }, { "version_value" : "1.4.8", "version_affected" : "=" }, { "version_value" : "1.4.9", "version_affected" : "=" }, { "version_value" : "1.4.10", "version_affected" : "=" }, { "version_value" : "1.4.11", "version_affected" : "=" }, { "version_value" : "1.4.12", "version_affected" : "=" }, { "version_value" : "1.4.13", "version_affected" : "=" }, { "version_value" : "1.5.0", "version_affected" : "=" }, { "version_value" : "1.6.0", "version_affected" : "=" }, { "version_value" : "1.6.1", "version_affected" : "=" }, { "version_value" : "1.7.0", "version_affected" : "=" }, { "version_value" : "1.8.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-918" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://dev.recurly.com/page/net-updates", "name" : "https://dev.recurly.com/page/net-updates", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://github.com/recurly/recurly-client-net/commit/9eef460c0084afd5c24d66220c8b7a381cf9a1f1", "name" : "https://github.com/recurly/recurly-client-net/commit/9eef460c0084afd5c24d66220c8b7a381cf9a1f1", "refsource" : "CONFIRM", "tags" : [ "Patch", "Third Party Advisory" ] }, { "url" : "https://hackerone.com/reports/288635", "name" : "https://hackerone.com/reports/288635", "refsource" : "MISC", "tags" : [ "Permissions Required" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The Recurly Client .NET Library before 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1 is vulnerable to a Server-Side Request Forgery vulnerability due to incorrect use of \"Uri.EscapeUriString\" that could result in compromise of API keys or other critical resources." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.0.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.0.0:beta1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.0.0:beta2:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.0.0:beta3:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.0.0:rc1:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.0.0.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.0.0.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.0.0.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.0.0.4:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.1.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.1.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.1.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.1.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.1.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.1.7:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.1.8:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.1.9:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.2.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.2.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.2.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.2.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.2.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.2.7:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.3.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.3.1:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.4.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.4.1:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.4.2:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.4.3:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.4.4:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.4.5:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.4.6:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.4.7:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.4.8:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.4.9:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.4.10:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.4.11:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.4.12:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.4.13:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.5.0:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.6.0:*:*:*:*:*:*:*" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.6.1:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.7.0:*:*:*:*:*:*:*" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:recurly:recurly_client_.net:1.8.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 9.8, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 3.9, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 7.5 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-13T17:29Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0908", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ ] } ] }, "references" : { "reference_data" : [ ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2017-16510. Reason: This candidate is a reservation duplicate of CVE-2017-16510. Notes: All CVE users should reference CVE-2017-16510 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ ] }, "impact" : { }, "publishedDate" : "2017-11-13T09:29Z", "lastModifiedDate" : "2017-11-13T09:29Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0909", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "private_address_check_project", "product" : { "product_data" : [ { "product_name" : "private_address_check", "version" : { "version_data" : [ { "version_value" : "0.1.0", "version_affected" : "=" }, { "version_value" : "0.2.0", "version_affected" : "=" }, { "version_value" : "0.3.0", "version_affected" : "=" }, { "version_value" : "0.4.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "NVD-CWE-noinfo" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://github.com/jtdowney/private_address_check/pull/3", "name" : "https://github.com/jtdowney/private_address_check/pull/3", "refsource" : "CONFIRM", "tags" : [ "Issue Tracking", "Third Party Advisory" ] }, { "url" : "https://hackerone.com/reports/288950", "name" : "https://hackerone.com/reports/288950", "refsource" : "MISC", "tags" : [ "Issue Tracking", "Patch", "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:private_address_check_project:private_address_check:*:*:*:*:*:ruby:*:*", "versionEndExcluding" : "0.4.1" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 9.8, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 3.9, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 7.5 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-16T22:29Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0910", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "zulip", "product" : { "product_data" : [ { "product_name" : "zulip_server", "version" : { "version_data" : [ { "version_value" : "1.1.5", "version_affected" : "=" }, { "version_value" : "1.2.0", "version_affected" : "=" }, { "version_value" : "1.2.1", "version_affected" : "=" }, { "version_value" : "1.3.0", "version_affected" : "=" }, { "version_value" : "1.3.1", "version_affected" : "=" }, { "version_value" : "1.3.2", "version_affected" : "=" }, { "version_value" : "1.3.3", "version_affected" : "=" }, { "version_value" : "1.3.4", "version_affected" : "=" }, { "version_value" : "1.3.5", "version_affected" : "=" }, { "version_value" : "1.3.6", "version_affected" : "=" }, { "version_value" : "1.3.7", "version_affected" : "=" }, { "version_value" : "1.3.8", "version_affected" : "=" }, { "version_value" : "1.3.9", "version_affected" : "=" }, { "version_value" : "1.3.10", "version_affected" : "=" }, { "version_value" : "1.3.11", "version_affected" : "=" }, { "version_value" : "1.3.12", "version_affected" : "=" }, { "version_value" : "1.3.13", "version_affected" : "=" }, { "version_value" : "1.4.0", "version_affected" : "=" }, { "version_value" : "1.4.1", "version_affected" : "=" }, { "version_value" : "1.4.2", "version_affected" : "=" }, { "version_value" : "1.4.3", "version_affected" : "=" }, { "version_value" : "1.5.0", "version_affected" : "=" }, { "version_value" : "1.5.1", "version_affected" : "=" }, { "version_value" : "1.5.2", "version_affected" : "=" }, { "version_value" : "1.6.0", "version_affected" : "=" }, { "version_value" : "1.7.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-287" } ] } ] }, "references" : { "reference_data" : [ { "url" : "http://blog.zulip.org/2017/11/23/zulip-1-7-1-released/", "name" : "http://blog.zulip.org/2017/11/23/zulip-1-7-1-released/", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://github.com/zulip/zulip/commit/960d736e55cbb9386a68e4ee45f80581fd2a4e32", "name" : "https://github.com/zulip/zulip/commit/960d736e55cbb9386a68e4ee45f80581fd2a4e32", "refsource" : "CONFIRM", "tags" : [ "Patch", "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "In Zulip Server before 1.7.1, on a server with multiple realms, a vulnerability in the invitation system lets an authorized user of one realm on the server create a user account on any other realm." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:zulip:zulip_server:*:*:*:*:*:*:*:*", "versionEndExcluding" : "1.7.1" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:S/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "SINGLE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2017-11-27T16:29Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0911", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "twitter", "product" : { "product_data" : [ { "product_name" : "twitter_kit", "version" : { "version_data" : [ { "version_value" : "3.0", "version_affected" : "=" }, { "version_value" : "3.0.1", "version_affected" : "=" }, { "version_value" : "3.0.2", "version_affected" : "=" }, { "version_value" : "3.0.3", "version_affected" : "=" }, { "version_value" : "3.0.4", "version_affected" : "=" }, { "version_value" : "3.1.0", "version_affected" : "=" }, { "version_value" : "3.1.1", "version_affected" : "=" }, { "version_value" : "3.2.0", "version_affected" : "=" }, { "version_value" : "3.2.1", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-287" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://blog.twitter.com/developer/en_us/topics/tips/2018/vulnerability-in-twitter-kit-for-ios.html", "name" : "https://blog.twitter.com/developer/en_us/topics/tips/2018/vulnerability-in-twitter-kit-for-ios.html", "refsource" : "CONFIRM", "tags" : [ "Third Party Advisory" ] }, { "url" : "https://github.com/twitter/twitter-kit-ios/blob/b6eb49d149b056d826cbc4b53eaeb39a3ebd591e/TwitterKit/TwitterKit/Social/Identity/TWTRMobileSSO.m#L71", "name" : "https://github.com/twitter/twitter-kit-ios/blob/b6eb49d149b056d826cbc4b53eaeb39a3ebd591e/TwitterKit/TwitterKit/Social/Identity/TWTRMobileSSO.m#L71", "refsource" : "CONFIRM", "tags" : [ "Patch", "Third Party Advisory" ] }, { "url" : "https://github.com/twitter/twitter-kit-ios/blob/b6eb49d149b056d826cbc4b53eaeb39a3ebd591e/TwitterKit/TwitterKit/TWTRTwitter.m#L411", "name" : "https://github.com/twitter/twitter-kit-ios/blob/b6eb49d149b056d826cbc4b53eaeb39a3ebd591e/TwitterKit/TwitterKit/TWTRTwitter.m#L411", "refsource" : "CONFIRM", "tags" : [ "Patch", "Third Party Advisory" ] }, { "url" : "https://github.com/twitter/twitter-kit-ios/wiki/Changelog#322-november-28-2017", "name" : "https://github.com/twitter/twitter-kit-ios/wiki/Changelog#322-november-28-2017", "refsource" : "CONFIRM", "tags" : [ "Release Notes", "Third Party Advisory" ] }, { "url" : "https://hackerone.com/reports/290229", "name" : "https://hackerone.com/reports/290229", "refsource" : "MISC", "tags" : [ "Permissions Required", "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Twitter Kit for iOS versions 3.0 to 3.2.1 is vulnerable to a callback verification flaw in the \"Login with Twitter\" component allowing an attacker to provide alternate credentials. In the final step of \"Login with Twitter\" authentication information is passed back to the application using the registered custom URL scheme (typically twitterkit-) on iOS. Because the callback handler did not verify the authenticity of the response, this step is vulnerable to forgery, potentially allowing attacker to associate a Twitter account with a third-party service." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:twitter:twitter_kit:*:*:*:*:*:iphone_os:*:*", "versionStartIncluding" : "3.0", "versionEndIncluding" : "3.2.1" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 5.4, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 2.5 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:S/C:P/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "SINGLE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 5.5 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.0, "impactScore" : 4.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2018-02-09T22:29Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0912", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "ui", "product" : { "product_data" : [ { "product_name" : "ucrm", "version" : { "version_data" : [ { "version_value" : "2.5.0", "version_affected" : "=" }, { "version_value" : "2.5.1", "version_affected" : "=" }, { "version_value" : "2.5.2", "version_affected" : "=" }, { "version_value" : "2.5.3", "version_affected" : "=" }, { "version_value" : "2.6.0", "version_affected" : "=" }, { "version_value" : "2.6.1", "version_affected" : "=" }, { "version_value" : "2.6.2", "version_affected" : "=" }, { "version_value" : "2.7.0", "version_affected" : "=" }, { "version_value" : "2.7.1", "version_affected" : "=" }, { "version_value" : "2.7.2", "version_affected" : "=" }, { "version_value" : "2.7.3", "version_affected" : "=" }, { "version_value" : "2.7.4", "version_affected" : "=" }, { "version_value" : "2.7.5", "version_affected" : "=" }, { "version_value" : "2.7.6", "version_affected" : "=" }, { "version_value" : "2.7.7", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-79" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://community.ubnt.com/t5/UCRM/New-UCRM-upgrades-available-2-8-2-and-2-9-0-beta3/td-p/2211814", "name" : "https://community.ubnt.com/t5/UCRM/New-UCRM-upgrades-available-2-8-2-and-2-9-0-beta3/td-p/2211814", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Ubiquiti UCRM versions 2.5.0 to 2.7.7 are vulnerable to Stored Cross-site Scripting. Due to the lack sanitization, it is possible to inject arbitrary HTML code by manipulating the uploaded filename. Successful exploitation requires valid credentials to an account with \"Edit\" access to \"Scheduling\"." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:ui:ucrm:*:*:*:*:*:*:*:*", "versionStartIncluding" : "2.5.0", "versionEndIncluding" : "2.7.7" } ] } ] }, "impact" : { "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:S/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "SINGLE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 3.5 }, "severity" : "LOW", "exploitabilityScore" : 6.8, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2018-07-03T21:29Z", "lastModifiedDate" : "2019-09-13T17:54Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0913", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-732" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://community.ubnt.com/t5/UCRM/New-UCRM-upgrades-available-2-8-2-and-2-9-0-beta3/td-p/2211814", "name" : "https://community.ubnt.com/t5/UCRM/New-UCRM-upgrades-available-2-8-2-and-2-9-0-beta3/td-p/2211814", "refsource" : "MISC", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://hackerone.com/reports/301406", "name" : "https://hackerone.com/reports/301406", "refsource" : "MISC", "tags" : [ "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Ubiquiti UCRM versions 2.3.0 to 2.7.7 allow an authenticated user to read arbitrary files in the local file system. Note that by default, the local file system is isolated in a docker container. Successful exploitation requires valid credentials to an account with \"Edit\" access to \"System Customization\"." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:ubnt:ucrm:*:*:*:*:*:*:*:*", "versionStartIncluding" : "2.3.0", "versionEndIncluding" : "2.7.7" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "LOCAL", "attackComplexity" : "HIGH", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.7, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 1.0, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:L/AC:M/Au:N/C:P/I:N/A:N", "accessVector" : "LOCAL", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 1.9 }, "severity" : "LOW", "exploitabilityScore" : 3.4, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2018-07-03T21:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0914", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "gitlab", "product" : { "product_data" : [ { "product_name" : "gitlab", "version" : { "version_data" : [ { "version_value" : "9.4.0", "version_affected" : "=" }, { "version_value" : "9.4.1", "version_affected" : "=" }, { "version_value" : "9.4.2", "version_affected" : "=" }, { "version_value" : "9.4.3", "version_affected" : "=" }, { "version_value" : "9.4.4", "version_affected" : "=" }, { "version_value" : "9.4.5", "version_affected" : "=" }, { "version_value" : "9.4.6", "version_affected" : "=" }, { "version_value" : "9.4.7", "version_affected" : "=" }, { "version_value" : "9.5.0", "version_affected" : "=" }, { "version_value" : "9.5.1", "version_affected" : "=" }, { "version_value" : "9.5.2", "version_affected" : "=" }, { "version_value" : "9.5.3", "version_affected" : "=" }, { "version_value" : "9.5.4", "version_affected" : "=" }, { "version_value" : "9.5.5", "version_affected" : "=" }, { "version_value" : "9.5.6", "version_affected" : "=" }, { "version_value" : "9.5.7", "version_affected" : "=" }, { "version_value" : "9.5.8", "version_affected" : "=" }, { "version_value" : "9.5.9", "version_affected" : "=" }, { "version_value" : "9.5.10", "version_affected" : "=" }, { "version_value" : "10.0.0", "version_affected" : "=" }, { "version_value" : "10.0.1", "version_affected" : "=" }, { "version_value" : "10.0.2", "version_affected" : "=" }, { "version_value" : "10.0.3", "version_affected" : "=" }, { "version_value" : "10.0.4", "version_affected" : "=" }, { "version_value" : "10.0.5", "version_affected" : "=" }, { "version_value" : "10.0.6", "version_affected" : "=" }, { "version_value" : "10.0.7", "version_affected" : "=" }, { "version_value" : "10.1.0", "version_affected" : "=" }, { "version_value" : "10.1.1", "version_affected" : "=" }, { "version_value" : "10.1.2", "version_affected" : "=" }, { "version_value" : "10.1.3", "version_affected" : "=" }, { "version_value" : "10.1.4", "version_affected" : "=" }, { "version_value" : "10.1.5", "version_affected" : "=" }, { "version_value" : "10.2.0", "version_affected" : "=" }, { "version_value" : "10.2.1", "version_affected" : "=" }, { "version_value" : "10.2.2", "version_affected" : "=" }, { "version_value" : "10.2.3", "version_affected" : "=" }, { "version_value" : "10.2.4", "version_affected" : "=" }, { "version_value" : "10.2.5", "version_affected" : "=" }, { "version_value" : "10.3.0", "version_affected" : "=" }, { "version_value" : "10.3.1", "version_affected" : "=" }, { "version_value" : "10.3.2", "version_affected" : "=" }, { "version_value" : "10.3.3", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-89" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/", "name" : "https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://hackerone.com/reports/298176", "name" : "https://hackerone.com/reports/298176", "refsource" : "MISC", "tags" : [ "Permissions Required" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Gitlab Community and Enterprise Editions version 10.1, 10.2, and 10.2.4 are vulnerable to a SQL injection in the MilestoneFinder component resulting in disclosure of all data in a GitLab instance's database." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding" : "9.4.0", "versionEndIncluding" : "9.5.10" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding" : "9.4.0", "versionEndIncluding" : "9.5.10" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding" : "10.0.0", "versionEndIncluding" : "10.1.5" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding" : "10.0.0", "versionEndIncluding" : "10.1.5" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding" : "10.2.0", "versionEndIncluding" : "10.2.5" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding" : "10.2.0", "versionEndIncluding" : "10.2.5" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding" : "10.3.0", "versionEndIncluding" : "10.3.3" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding" : "10.3.0", "versionEndIncluding" : "10.3.3" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2018-03-21T20:29Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0915", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "gitlab", "product" : { "product_data" : [ { "product_name" : "gitlab", "version" : { "version_data" : [ { "version_value" : "8.9.0", "version_affected" : "=" }, { "version_value" : "8.9.1", "version_affected" : "=" }, { "version_value" : "8.9.2", "version_affected" : "=" }, { "version_value" : "8.9.3", "version_affected" : "=" }, { "version_value" : "8.9.4", "version_affected" : "=" }, { "version_value" : "8.9.5", "version_affected" : "=" }, { "version_value" : "8.9.6", "version_affected" : "=" }, { "version_value" : "8.9.7", "version_affected" : "=" }, { "version_value" : "8.9.8", "version_affected" : "=" }, { "version_value" : "8.9.9", "version_affected" : "=" }, { "version_value" : "8.9.10", "version_affected" : "=" }, { "version_value" : "8.9.11", "version_affected" : "=" }, { "version_value" : "8.10.0", "version_affected" : "=" }, { "version_value" : "8.10.1", "version_affected" : "=" }, { "version_value" : "8.10.2", "version_affected" : "=" }, { "version_value" : "8.10.3", "version_affected" : "=" }, { "version_value" : "8.10.4", "version_affected" : "=" }, { "version_value" : "8.10.5", "version_affected" : "=" }, { "version_value" : "8.10.6", "version_affected" : "=" }, { "version_value" : "8.10.7", "version_affected" : "=" }, { "version_value" : "8.10.8", "version_affected" : "=" }, { "version_value" : "8.10.9", "version_affected" : "=" }, { "version_value" : "8.10.10", "version_affected" : "=" }, { "version_value" : "8.10.11", "version_affected" : "=" }, { "version_value" : "8.10.12", "version_affected" : "=" }, { "version_value" : "8.10.13", "version_affected" : "=" }, { "version_value" : "8.11.0", "version_affected" : "=" }, { "version_value" : "8.11.1", "version_affected" : "=" }, { "version_value" : "8.11.2", "version_affected" : "=" }, { "version_value" : "8.11.3", "version_affected" : "=" }, { "version_value" : "8.11.4", "version_affected" : "=" }, { "version_value" : "8.11.5", "version_affected" : "=" }, { "version_value" : "8.11.6", "version_affected" : "=" }, { "version_value" : "8.11.7", "version_affected" : "=" }, { "version_value" : "8.11.8", "version_affected" : "=" }, { "version_value" : "8.11.9", "version_affected" : "=" }, { "version_value" : "8.11.10", "version_affected" : "=" }, { "version_value" : "8.11.11", "version_affected" : "=" }, { "version_value" : "8.12.0", "version_affected" : "=" }, { "version_value" : "8.12.1", "version_affected" : "=" }, { "version_value" : "8.12.2", "version_affected" : "=" }, { "version_value" : "8.12.3", "version_affected" : "=" }, { "version_value" : "8.12.4", "version_affected" : "=" }, { "version_value" : "8.12.5", "version_affected" : "=" }, { "version_value" : "8.12.6", "version_affected" : "=" }, { "version_value" : "8.12.7", "version_affected" : "=" }, { "version_value" : "8.12.8", "version_affected" : "=" }, { "version_value" : "8.12.9", "version_affected" : "=" }, { "version_value" : "8.12.10", "version_affected" : "=" }, { "version_value" : "8.12.11", "version_affected" : "=" }, { "version_value" : "8.12.12", "version_affected" : "=" }, { "version_value" : "8.12.13", "version_affected" : "=" }, { "version_value" : "8.13.0", "version_affected" : "=" }, { "version_value" : "8.13.1", "version_affected" : "=" }, { "version_value" : "8.13.2", "version_affected" : "=" }, { "version_value" : "8.13.3", "version_affected" : "=" }, { "version_value" : "8.13.4", "version_affected" : "=" }, { "version_value" : "8.13.5", "version_affected" : "=" }, { "version_value" : "8.13.6", "version_affected" : "=" }, { "version_value" : "8.13.7", "version_affected" : "=" }, { "version_value" : "8.13.8", "version_affected" : "=" }, { "version_value" : "8.13.9", "version_affected" : "=" }, { "version_value" : "8.13.10", "version_affected" : "=" }, { "version_value" : "8.13.11", "version_affected" : "=" }, { "version_value" : "8.13.12", "version_affected" : "=" }, { "version_value" : "8.14.0", "version_affected" : "=" }, { "version_value" : "8.14.1", "version_affected" : "=" }, { "version_value" : "8.14.2", "version_affected" : "=" }, { "version_value" : "8.14.3", "version_affected" : "=" }, { "version_value" : "8.14.4", "version_affected" : "=" }, { "version_value" : "8.14.5", "version_affected" : "=" }, { "version_value" : "8.14.6", "version_affected" : "=" }, { "version_value" : "8.14.7", "version_affected" : "=" }, { "version_value" : "8.14.8", "version_affected" : "=" }, { "version_value" : "8.14.9", "version_affected" : "=" }, { "version_value" : "8.14.10", "version_affected" : "=" }, { "version_value" : "8.15.0", "version_affected" : "=" }, { "version_value" : "8.15.1", "version_affected" : "=" }, { "version_value" : "8.15.2", "version_affected" : "=" }, { "version_value" : "8.15.3", "version_affected" : "=" }, { "version_value" : "8.15.4", "version_affected" : "=" }, { "version_value" : "8.15.5", "version_affected" : "=" }, { "version_value" : "8.15.6", "version_affected" : "=" }, { "version_value" : "8.15.7", "version_affected" : "=" }, { "version_value" : "8.15.8", "version_affected" : "=" }, { "version_value" : "8.16.0", "version_affected" : "=" }, { "version_value" : "8.16.1", "version_affected" : "=" }, { "version_value" : "8.16.2", "version_affected" : "=" }, { "version_value" : "8.16.3", "version_affected" : "=" }, { "version_value" : "8.16.4", "version_affected" : "=" }, { "version_value" : "8.16.5", "version_affected" : "=" }, { "version_value" : "8.16.6", "version_affected" : "=" }, { "version_value" : "8.16.7", "version_affected" : "=" }, { "version_value" : "8.16.8", "version_affected" : "=" }, { "version_value" : "8.16.9", "version_affected" : "=" }, { "version_value" : "8.17.0", "version_affected" : "=" }, { "version_value" : "8.17.1", "version_affected" : "=" }, { "version_value" : "8.17.2", "version_affected" : "=" }, { "version_value" : "8.17.3", "version_affected" : "=" }, { "version_value" : "8.17.4", "version_affected" : "=" }, { "version_value" : "8.17.5", "version_affected" : "=" }, { "version_value" : "8.17.6", "version_affected" : "=" }, { "version_value" : "8.17.7", "version_affected" : "=" }, { "version_value" : "8.17.8", "version_affected" : "=" }, { "version_value" : "8.18.0", "version_affected" : "=" }, { "version_value" : "9.0.0", "version_affected" : "=" }, { "version_value" : "9.0.1", "version_affected" : "=" }, { "version_value" : "9.0.2", "version_affected" : "=" }, { "version_value" : "9.0.3", "version_affected" : "=" }, { "version_value" : "9.0.4", "version_affected" : "=" }, { "version_value" : "9.0.5", "version_affected" : "=" }, { "version_value" : "9.0.6", "version_affected" : "=" }, { "version_value" : "9.0.7", "version_affected" : "=" }, { "version_value" : "9.0.8", "version_affected" : "=" }, { "version_value" : "9.0.9", "version_affected" : "=" }, { "version_value" : "9.0.10", "version_affected" : "=" }, { "version_value" : "9.0.11", "version_affected" : "=" }, { "version_value" : "9.0.12", "version_affected" : "=" }, { "version_value" : "9.0.13", "version_affected" : "=" }, { "version_value" : "9.1.0", "version_affected" : "=" }, { "version_value" : "9.1.1", "version_affected" : "=" }, { "version_value" : "9.1.2", "version_affected" : "=" }, { "version_value" : "9.1.3", "version_affected" : "=" }, { "version_value" : "9.1.4", "version_affected" : "=" }, { "version_value" : "9.1.5", "version_affected" : "=" }, { "version_value" : "9.1.6", "version_affected" : "=" }, { "version_value" : "9.1.7", "version_affected" : "=" }, { "version_value" : "9.1.8", "version_affected" : "=" }, { "version_value" : "9.1.9", "version_affected" : "=" }, { "version_value" : "9.1.10", "version_affected" : "=" }, { "version_value" : "9.2.0", "version_affected" : "=" }, { "version_value" : "9.2.1", "version_affected" : "=" }, { "version_value" : "9.2.2", "version_affected" : "=" }, { "version_value" : "9.2.3", "version_affected" : "=" }, { "version_value" : "9.2.4", "version_affected" : "=" }, { "version_value" : "9.2.5", "version_affected" : "=" }, { "version_value" : "9.2.6", "version_affected" : "=" }, { "version_value" : "9.2.7", "version_affected" : "=" }, { "version_value" : "9.2.8", "version_affected" : "=" }, { "version_value" : "9.2.9", "version_affected" : "=" }, { "version_value" : "9.2.10", "version_affected" : "=" }, { "version_value" : "9.3.0", "version_affected" : "=" }, { "version_value" : "9.3.1", "version_affected" : "=" }, { "version_value" : "9.3.2", "version_affected" : "=" }, { "version_value" : "9.3.3", "version_affected" : "=" }, { "version_value" : "9.3.4", "version_affected" : "=" }, { "version_value" : "9.3.5", "version_affected" : "=" }, { "version_value" : "9.3.6", "version_affected" : "=" }, { "version_value" : "9.3.7", "version_affected" : "=" }, { "version_value" : "9.3.8", "version_affected" : "=" }, { "version_value" : "9.3.9", "version_affected" : "=" }, { "version_value" : "9.3.10", "version_affected" : "=" }, { "version_value" : "9.3.11", "version_affected" : "=" }, { "version_value" : "9.4.0", "version_affected" : "=" }, { "version_value" : "9.4.1", "version_affected" : "=" }, { "version_value" : "9.4.2", "version_affected" : "=" }, { "version_value" : "9.4.3", "version_affected" : "=" }, { "version_value" : "9.4.4", "version_affected" : "=" }, { "version_value" : "9.4.5", "version_affected" : "=" }, { "version_value" : "9.4.6", "version_affected" : "=" }, { "version_value" : "9.4.7", "version_affected" : "=" }, { "version_value" : "9.5.0", "version_affected" : "=" }, { "version_value" : "9.5.1", "version_affected" : "=" }, { "version_value" : "9.5.2", "version_affected" : "=" }, { "version_value" : "9.5.3", "version_affected" : "=" }, { "version_value" : "9.5.4", "version_affected" : "=" }, { "version_value" : "9.5.5", "version_affected" : "=" }, { "version_value" : "9.5.6", "version_affected" : "=" }, { "version_value" : "9.5.7", "version_affected" : "=" }, { "version_value" : "9.5.8", "version_affected" : "=" }, { "version_value" : "9.5.9", "version_affected" : "=" }, { "version_value" : "9.5.10", "version_affected" : "=" }, { "version_value" : "10.0.0", "version_affected" : "=" }, { "version_value" : "10.0.1", "version_affected" : "=" }, { "version_value" : "10.0.2", "version_affected" : "=" }, { "version_value" : "10.0.3", "version_affected" : "=" }, { "version_value" : "10.0.4", "version_affected" : "=" }, { "version_value" : "10.0.5", "version_affected" : "=" }, { "version_value" : "10.0.6", "version_affected" : "=" }, { "version_value" : "10.0.7", "version_affected" : "=" }, { "version_value" : "10.1.0", "version_affected" : "=" }, { "version_value" : "10.1.1", "version_affected" : "=" }, { "version_value" : "10.1.2", "version_affected" : "=" }, { "version_value" : "10.1.3", "version_affected" : "=" }, { "version_value" : "10.1.4", "version_affected" : "=" }, { "version_value" : "10.1.5", "version_affected" : "=" }, { "version_value" : "10.2.0", "version_affected" : "=" }, { "version_value" : "10.2.1", "version_affected" : "=" }, { "version_value" : "10.2.2", "version_affected" : "=" }, { "version_value" : "10.2.3", "version_affected" : "=" }, { "version_value" : "10.2.4", "version_affected" : "=" }, { "version_value" : "10.2.5", "version_affected" : "=" }, { "version_value" : "10.3.0", "version_affected" : "=" }, { "version_value" : "10.3.1", "version_affected" : "=" }, { "version_value" : "10.3.2", "version_affected" : "=" }, { "version_value" : "10.3.3", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "debian", "product" : { "product_data" : [ { "product_name" : "debian_linux", "version" : { "version_data" : [ { "version_value" : "9.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/", "name" : "https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://hackerone.com/reports/298873", "name" : "https://hackerone.com/reports/298873", "refsource" : "MISC", "tags" : [ "Permissions Required" ] }, { "url" : "https://www.debian.org/security/2018/dsa-4145", "name" : "DSA-4145", "refsource" : "DEBIAN", "tags" : [ "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Gitlab Community Edition version 10.2.4 is vulnerable to a lack of input validation in the GitlabProjectsImportService resulting in remote code execution." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding" : "8.9.0", "versionEndIncluding" : "9.5.10" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding" : "8.9.0", "versionEndIncluding" : "9.5.10" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding" : "10.0.0", "versionEndIncluding" : "10.1.5" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding" : "10.0.0", "versionEndIncluding" : "10.1.5" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding" : "10.2.0", "versionEndIncluding" : "10.2.5" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding" : "10.2.0", "versionEndIncluding" : "10.2.5" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding" : "10.3.0", "versionEndIncluding" : "10.3.3" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding" : "10.3.0", "versionEndIncluding" : "10.3.3" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 9.8, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 3.9, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 7.5 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2018-03-21T20:29Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0916", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "gitlab", "product" : { "product_data" : [ { "product_name" : "gitlab", "version" : { "version_data" : [ { "version_value" : "8.8.0", "version_affected" : "=" }, { "version_value" : "8.8.1", "version_affected" : "=" }, { "version_value" : "8.8.2", "version_affected" : "=" }, { "version_value" : "8.8.3", "version_affected" : "=" }, { "version_value" : "8.8.4", "version_affected" : "=" }, { "version_value" : "8.8.5", "version_affected" : "=" }, { "version_value" : "8.8.6", "version_affected" : "=" }, { "version_value" : "8.8.7", "version_affected" : "=" }, { "version_value" : "8.8.8", "version_affected" : "=" }, { "version_value" : "8.8.9", "version_affected" : "=" }, { "version_value" : "8.9.0", "version_affected" : "=" }, { "version_value" : "8.9.1", "version_affected" : "=" }, { "version_value" : "8.9.2", "version_affected" : "=" }, { "version_value" : "8.9.3", "version_affected" : "=" }, { "version_value" : "8.9.4", "version_affected" : "=" }, { "version_value" : "8.9.5", "version_affected" : "=" }, { "version_value" : "8.9.6", "version_affected" : "=" }, { "version_value" : "8.9.7", "version_affected" : "=" }, { "version_value" : "8.9.8", "version_affected" : "=" }, { "version_value" : "8.9.9", "version_affected" : "=" }, { "version_value" : "8.9.10", "version_affected" : "=" }, { "version_value" : "8.9.11", "version_affected" : "=" }, { "version_value" : "8.10.0", "version_affected" : "=" }, { "version_value" : "8.10.1", "version_affected" : "=" }, { "version_value" : "8.10.2", "version_affected" : "=" }, { "version_value" : "8.10.3", "version_affected" : "=" }, { "version_value" : "8.10.4", "version_affected" : "=" }, { "version_value" : "8.10.5", "version_affected" : "=" }, { "version_value" : "8.10.6", "version_affected" : "=" }, { "version_value" : "8.10.7", "version_affected" : "=" }, { "version_value" : "8.10.8", "version_affected" : "=" }, { "version_value" : "8.10.9", "version_affected" : "=" }, { "version_value" : "8.10.10", "version_affected" : "=" }, { "version_value" : "8.10.11", "version_affected" : "=" }, { "version_value" : "8.10.12", "version_affected" : "=" }, { "version_value" : "8.10.13", "version_affected" : "=" }, { "version_value" : "8.11.0", "version_affected" : "=" }, { "version_value" : "8.11.1", "version_affected" : "=" }, { "version_value" : "8.11.2", "version_affected" : "=" }, { "version_value" : "8.11.3", "version_affected" : "=" }, { "version_value" : "8.11.4", "version_affected" : "=" }, { "version_value" : "8.11.5", "version_affected" : "=" }, { "version_value" : "8.11.6", "version_affected" : "=" }, { "version_value" : "8.11.7", "version_affected" : "=" }, { "version_value" : "8.11.8", "version_affected" : "=" }, { "version_value" : "8.11.9", "version_affected" : "=" }, { "version_value" : "8.11.10", "version_affected" : "=" }, { "version_value" : "8.11.11", "version_affected" : "=" }, { "version_value" : "8.12.0", "version_affected" : "=" }, { "version_value" : "8.12.1", "version_affected" : "=" }, { "version_value" : "8.12.2", "version_affected" : "=" }, { "version_value" : "8.12.3", "version_affected" : "=" }, { "version_value" : "8.12.4", "version_affected" : "=" }, { "version_value" : "8.12.5", "version_affected" : "=" }, { "version_value" : "8.12.6", "version_affected" : "=" }, { "version_value" : "8.12.7", "version_affected" : "=" }, { "version_value" : "8.12.8", "version_affected" : "=" }, { "version_value" : "8.12.9", "version_affected" : "=" }, { "version_value" : "8.12.10", "version_affected" : "=" }, { "version_value" : "8.12.11", "version_affected" : "=" }, { "version_value" : "8.12.12", "version_affected" : "=" }, { "version_value" : "8.12.13", "version_affected" : "=" }, { "version_value" : "8.13.0", "version_affected" : "=" }, { "version_value" : "8.13.1", "version_affected" : "=" }, { "version_value" : "8.13.2", "version_affected" : "=" }, { "version_value" : "8.13.3", "version_affected" : "=" }, { "version_value" : "8.13.4", "version_affected" : "=" }, { "version_value" : "8.13.5", "version_affected" : "=" }, { "version_value" : "8.13.6", "version_affected" : "=" }, { "version_value" : "8.13.7", "version_affected" : "=" }, { "version_value" : "8.13.8", "version_affected" : "=" }, { "version_value" : "8.13.9", "version_affected" : "=" }, { "version_value" : "8.13.10", "version_affected" : "=" }, { "version_value" : "8.13.11", "version_affected" : "=" }, { "version_value" : "8.13.12", "version_affected" : "=" }, { "version_value" : "8.14.0", "version_affected" : "=" }, { "version_value" : "8.14.1", "version_affected" : "=" }, { "version_value" : "8.14.2", "version_affected" : "=" }, { "version_value" : "8.14.3", "version_affected" : "=" }, { "version_value" : "8.14.4", "version_affected" : "=" }, { "version_value" : "8.14.5", "version_affected" : "=" }, { "version_value" : "8.14.6", "version_affected" : "=" }, { "version_value" : "8.14.7", "version_affected" : "=" }, { "version_value" : "8.14.8", "version_affected" : "=" }, { "version_value" : "8.14.9", "version_affected" : "=" }, { "version_value" : "8.14.10", "version_affected" : "=" }, { "version_value" : "8.15.0", "version_affected" : "=" }, { "version_value" : "8.15.1", "version_affected" : "=" }, { "version_value" : "8.15.2", "version_affected" : "=" }, { "version_value" : "8.15.3", "version_affected" : "=" }, { "version_value" : "8.15.4", "version_affected" : "=" }, { "version_value" : "8.15.5", "version_affected" : "=" }, { "version_value" : "8.15.6", "version_affected" : "=" }, { "version_value" : "8.15.7", "version_affected" : "=" }, { "version_value" : "8.15.8", "version_affected" : "=" }, { "version_value" : "8.16.0", "version_affected" : "=" }, { "version_value" : "8.16.1", "version_affected" : "=" }, { "version_value" : "8.16.2", "version_affected" : "=" }, { "version_value" : "8.16.3", "version_affected" : "=" }, { "version_value" : "8.16.4", "version_affected" : "=" }, { "version_value" : "8.16.5", "version_affected" : "=" }, { "version_value" : "8.16.6", "version_affected" : "=" }, { "version_value" : "8.16.7", "version_affected" : "=" }, { "version_value" : "8.16.8", "version_affected" : "=" }, { "version_value" : "8.16.9", "version_affected" : "=" }, { "version_value" : "8.17.0", "version_affected" : "=" }, { "version_value" : "8.17.1", "version_affected" : "=" }, { "version_value" : "8.17.2", "version_affected" : "=" }, { "version_value" : "8.17.3", "version_affected" : "=" }, { "version_value" : "8.17.4", "version_affected" : "=" }, { "version_value" : "8.17.5", "version_affected" : "=" }, { "version_value" : "8.17.6", "version_affected" : "=" }, { "version_value" : "8.17.7", "version_affected" : "=" }, { "version_value" : "8.17.8", "version_affected" : "=" }, { "version_value" : "8.18.0", "version_affected" : "=" }, { "version_value" : "9.0.0", "version_affected" : "=" }, { "version_value" : "9.0.1", "version_affected" : "=" }, { "version_value" : "9.0.2", "version_affected" : "=" }, { "version_value" : "9.0.3", "version_affected" : "=" }, { "version_value" : "9.0.4", "version_affected" : "=" }, { "version_value" : "9.0.5", "version_affected" : "=" }, { "version_value" : "9.0.6", "version_affected" : "=" }, { "version_value" : "9.0.7", "version_affected" : "=" }, { "version_value" : "9.0.8", "version_affected" : "=" }, { "version_value" : "9.0.9", "version_affected" : "=" }, { "version_value" : "9.0.10", "version_affected" : "=" }, { "version_value" : "9.0.11", "version_affected" : "=" }, { "version_value" : "9.0.12", "version_affected" : "=" }, { "version_value" : "9.0.13", "version_affected" : "=" }, { "version_value" : "9.1.0", "version_affected" : "=" }, { "version_value" : "9.1.1", "version_affected" : "=" }, { "version_value" : "9.1.2", "version_affected" : "=" }, { "version_value" : "9.1.3", "version_affected" : "=" }, { "version_value" : "9.1.4", "version_affected" : "=" }, { "version_value" : "9.1.5", "version_affected" : "=" }, { "version_value" : "9.1.6", "version_affected" : "=" }, { "version_value" : "9.1.7", "version_affected" : "=" }, { "version_value" : "9.1.8", "version_affected" : "=" }, { "version_value" : "9.1.9", "version_affected" : "=" }, { "version_value" : "9.1.10", "version_affected" : "=" }, { "version_value" : "9.2.0", "version_affected" : "=" }, { "version_value" : "9.2.1", "version_affected" : "=" }, { "version_value" : "9.2.2", "version_affected" : "=" }, { "version_value" : "9.2.3", "version_affected" : "=" }, { "version_value" : "9.2.4", "version_affected" : "=" }, { "version_value" : "9.2.5", "version_affected" : "=" }, { "version_value" : "9.2.6", "version_affected" : "=" }, { "version_value" : "9.2.7", "version_affected" : "=" }, { "version_value" : "9.2.8", "version_affected" : "=" }, { "version_value" : "9.2.9", "version_affected" : "=" }, { "version_value" : "9.2.10", "version_affected" : "=" }, { "version_value" : "9.3.0", "version_affected" : "=" }, { "version_value" : "9.3.1", "version_affected" : "=" }, { "version_value" : "9.3.2", "version_affected" : "=" }, { "version_value" : "9.3.3", "version_affected" : "=" }, { "version_value" : "9.3.4", "version_affected" : "=" }, { "version_value" : "9.3.5", "version_affected" : "=" }, { "version_value" : "9.3.6", "version_affected" : "=" }, { "version_value" : "9.3.7", "version_affected" : "=" }, { "version_value" : "9.3.8", "version_affected" : "=" }, { "version_value" : "9.3.9", "version_affected" : "=" }, { "version_value" : "9.3.10", "version_affected" : "=" }, { "version_value" : "9.3.11", "version_affected" : "=" }, { "version_value" : "9.4.0", "version_affected" : "=" }, { "version_value" : "9.4.1", "version_affected" : "=" }, { "version_value" : "9.4.2", "version_affected" : "=" }, { "version_value" : "9.4.3", "version_affected" : "=" }, { "version_value" : "9.4.4", "version_affected" : "=" }, { "version_value" : "9.4.5", "version_affected" : "=" }, { "version_value" : "9.4.6", "version_affected" : "=" }, { "version_value" : "9.4.7", "version_affected" : "=" }, { "version_value" : "9.5.0", "version_affected" : "=" }, { "version_value" : "9.5.1", "version_affected" : "=" }, { "version_value" : "9.5.2", "version_affected" : "=" }, { "version_value" : "9.5.3", "version_affected" : "=" }, { "version_value" : "9.5.4", "version_affected" : "=" }, { "version_value" : "9.5.5", "version_affected" : "=" }, { "version_value" : "9.5.6", "version_affected" : "=" }, { "version_value" : "9.5.7", "version_affected" : "=" }, { "version_value" : "9.5.8", "version_affected" : "=" }, { "version_value" : "9.5.9", "version_affected" : "=" }, { "version_value" : "9.5.10", "version_affected" : "=" }, { "version_value" : "9.6.0", "version_affected" : "=" }, { "version_value" : "10.0.0", "version_affected" : "=" }, { "version_value" : "10.0.1", "version_affected" : "=" }, { "version_value" : "10.0.2", "version_affected" : "=" }, { "version_value" : "10.0.3", "version_affected" : "=" }, { "version_value" : "10.0.4", "version_affected" : "=" }, { "version_value" : "10.0.5", "version_affected" : "=" }, { "version_value" : "10.0.6", "version_affected" : "=" }, { "version_value" : "10.0.7", "version_affected" : "=" }, { "version_value" : "10.1.0", "version_affected" : "=" }, { "version_value" : "10.1.1", "version_affected" : "=" }, { "version_value" : "10.1.2", "version_affected" : "=" }, { "version_value" : "10.1.3", "version_affected" : "=" }, { "version_value" : "10.1.4", "version_affected" : "=" }, { "version_value" : "10.1.5", "version_affected" : "=" }, { "version_value" : "10.2.0", "version_affected" : "=" }, { "version_value" : "10.2.1", "version_affected" : "=" }, { "version_value" : "10.2.2", "version_affected" : "=" }, { "version_value" : "10.2.3", "version_affected" : "=" }, { "version_value" : "10.2.4", "version_affected" : "=" }, { "version_value" : "10.2.5", "version_affected" : "=" }, { "version_value" : "10.3.0", "version_affected" : "=" }, { "version_value" : "10.3.1", "version_affected" : "=" }, { "version_value" : "10.3.2", "version_affected" : "=" }, { "version_value" : "10.3.3", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "debian", "product" : { "product_data" : [ { "product_name" : "debian_linux", "version" : { "version_data" : [ { "version_value" : "9.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/", "name" : "https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://hackerone.com/reports/299473", "name" : "https://hackerone.com/reports/299473", "refsource" : "MISC", "tags" : [ "Permissions Required" ] }, { "url" : "https://www.debian.org/security/2018/dsa-4145", "name" : "DSA-4145", "refsource" : "DEBIAN", "tags" : [ "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Gitlab Community Edition version 10.3 is vulnerable to a lack of input validation in the system_hook_push queue through web hook component resulting in remote code execution." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding" : "8.8.0", "versionEndIncluding" : "10.1.5" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding" : "8.8.0", "versionEndIncluding" : "10.1.5" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding" : "10.2.0", "versionEndIncluding" : "10.2.5" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding" : "10.2.0", "versionEndIncluding" : "10.2.5" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding" : "10.3.0", "versionEndIncluding" : "10.3.3" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding" : "10.3.0", "versionEndIncluding" : "10.3.3" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 9.8, "baseSeverity" : "CRITICAL" }, "exploitabilityScore" : 3.9, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 7.5 }, "severity" : "HIGH", "exploitabilityScore" : 10.0, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2018-03-21T20:29Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0917", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "gitlab", "product" : { "product_data" : [ { "product_name" : "gitlab", "version" : { "version_data" : [ { "version_value" : "10.1.0", "version_affected" : "=" }, { "version_value" : "10.1.1", "version_affected" : "=" }, { "version_value" : "10.1.2", "version_affected" : "=" }, { "version_value" : "10.1.3", "version_affected" : "=" }, { "version_value" : "10.1.4", "version_affected" : "=" }, { "version_value" : "10.1.5", "version_affected" : "=" }, { "version_value" : "10.2.0", "version_affected" : "=" }, { "version_value" : "10.2.1", "version_affected" : "=" }, { "version_value" : "10.2.2", "version_affected" : "=" }, { "version_value" : "10.2.3", "version_affected" : "=" }, { "version_value" : "10.2.4", "version_affected" : "=" }, { "version_value" : "10.2.5", "version_affected" : "=" }, { "version_value" : "10.3.0", "version_affected" : "=" }, { "version_value" : "10.3.1", "version_affected" : "=" }, { "version_value" : "10.3.2", "version_affected" : "=" }, { "version_value" : "10.3.3", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "debian", "product" : { "product_data" : [ { "product_name" : "debian_linux", "version" : { "version_data" : [ { "version_value" : "9.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-79" }, { "lang" : "en", "value" : "CWE-20" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/", "name" : "https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://hackerone.com/reports/299525", "name" : "https://hackerone.com/reports/299525", "refsource" : "MISC", "tags" : [ "Permissions Required" ] }, { "url" : "https://www.debian.org/security/2018/dsa-4145", "name" : "DSA-4145", "refsource" : "DEBIAN", "tags" : [ "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the CI job component resulting in persistent cross site scripting." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding" : "10.1.0", "versionEndIncluding" : "10.1.5" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding" : "10.1.0", "versionEndIncluding" : "10.1.5" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding" : "10.2.0", "versionEndIncluding" : "10.2.5" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding" : "10.2.0", "versionEndIncluding" : "10.2.5" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding" : "10.3.0", "versionEndIncluding" : "10.3.3" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding" : "10.3.0", "versionEndIncluding" : "10.3.3" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "REQUIRED", "scope" : "CHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "LOW", "availabilityImpact" : "NONE", "baseScore" : 6.1, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 2.7 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:M/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "MEDIUM", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 4.3 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.6, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : true } }, "publishedDate" : "2018-03-21T20:29Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0918", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "gitlab", "product" : { "product_data" : [ { "product_name" : "gitlab", "version" : { "version_data" : [ { "version_value" : "8.4.0", "version_affected" : "=" }, { "version_value" : "8.4.1", "version_affected" : "=" }, { "version_value" : "8.4.2", "version_affected" : "=" }, { "version_value" : "8.4.3", "version_affected" : "=" }, { "version_value" : "8.4.4", "version_affected" : "=" }, { "version_value" : "8.4.5", "version_affected" : "=" }, { "version_value" : "8.4.6", "version_affected" : "=" }, { "version_value" : "8.4.7", "version_affected" : "=" }, { "version_value" : "8.4.8", "version_affected" : "=" }, { "version_value" : "8.4.9", "version_affected" : "=" }, { "version_value" : "8.4.10", "version_affected" : "=" }, { "version_value" : "8.4.11", "version_affected" : "=" }, { "version_value" : "8.5.0", "version_affected" : "=" }, { "version_value" : "8.5.1", "version_affected" : "=" }, { "version_value" : "8.5.2", "version_affected" : "=" }, { "version_value" : "8.5.3", "version_affected" : "=" }, { "version_value" : "8.5.4", "version_affected" : "=" }, { "version_value" : "8.5.5", "version_affected" : "=" }, { "version_value" : "8.5.6", "version_affected" : "=" }, { "version_value" : "8.5.7", "version_affected" : "=" }, { "version_value" : "8.5.8", "version_affected" : "=" }, { "version_value" : "8.5.9", "version_affected" : "=" }, { "version_value" : "8.5.10", "version_affected" : "=" }, { "version_value" : "8.5.11", "version_affected" : "=" }, { "version_value" : "8.5.12", "version_affected" : "=" }, { "version_value" : "8.5.13", "version_affected" : "=" }, { "version_value" : "8.6.0", "version_affected" : "=" }, { "version_value" : "8.6.1", "version_affected" : "=" }, { "version_value" : "8.6.2", "version_affected" : "=" }, { "version_value" : "8.6.3", "version_affected" : "=" }, { "version_value" : "8.6.4", "version_affected" : "=" }, { "version_value" : "8.6.5", "version_affected" : "=" }, { "version_value" : "8.6.6", "version_affected" : "=" }, { "version_value" : "8.6.7", "version_affected" : "=" }, { "version_value" : "8.6.8", "version_affected" : "=" }, { "version_value" : "8.6.9", "version_affected" : "=" }, { "version_value" : "8.7.0", "version_affected" : "=" }, { "version_value" : "8.7.1", "version_affected" : "=" }, { "version_value" : "8.7.2", "version_affected" : "=" }, { "version_value" : "8.7.3", "version_affected" : "=" }, { "version_value" : "8.7.4", "version_affected" : "=" }, { "version_value" : "8.7.5", "version_affected" : "=" }, { "version_value" : "8.7.6", "version_affected" : "=" }, { "version_value" : "8.7.7", "version_affected" : "=" }, { "version_value" : "8.7.8", "version_affected" : "=" }, { "version_value" : "8.7.9", "version_affected" : "=" }, { "version_value" : "8.8.0", "version_affected" : "=" }, { "version_value" : "8.8.1", "version_affected" : "=" }, { "version_value" : "8.8.2", "version_affected" : "=" }, { "version_value" : "8.8.3", "version_affected" : "=" }, { "version_value" : "8.8.4", "version_affected" : "=" }, { "version_value" : "8.8.5", "version_affected" : "=" }, { "version_value" : "8.8.6", "version_affected" : "=" }, { "version_value" : "8.8.7", "version_affected" : "=" }, { "version_value" : "8.8.8", "version_affected" : "=" }, { "version_value" : "8.8.9", "version_affected" : "=" }, { "version_value" : "8.9.0", "version_affected" : "=" }, { "version_value" : "8.9.1", "version_affected" : "=" }, { "version_value" : "8.9.2", "version_affected" : "=" }, { "version_value" : "8.9.3", "version_affected" : "=" }, { "version_value" : "8.9.4", "version_affected" : "=" }, { "version_value" : "8.9.5", "version_affected" : "=" }, { "version_value" : "8.9.6", "version_affected" : "=" }, { "version_value" : "8.9.7", "version_affected" : "=" }, { "version_value" : "8.9.8", "version_affected" : "=" }, { "version_value" : "8.9.9", "version_affected" : "=" }, { "version_value" : "8.9.10", "version_affected" : "=" }, { "version_value" : "8.9.11", "version_affected" : "=" }, { "version_value" : "8.10.0", "version_affected" : "=" }, { "version_value" : "8.10.1", "version_affected" : "=" }, { "version_value" : "8.10.2", "version_affected" : "=" }, { "version_value" : "8.10.3", "version_affected" : "=" }, { "version_value" : "8.10.4", "version_affected" : "=" }, { "version_value" : "8.10.5", "version_affected" : "=" }, { "version_value" : "8.10.6", "version_affected" : "=" }, { "version_value" : "8.10.7", "version_affected" : "=" }, { "version_value" : "8.10.8", "version_affected" : "=" }, { "version_value" : "8.10.9", "version_affected" : "=" }, { "version_value" : "8.10.10", "version_affected" : "=" }, { "version_value" : "8.10.11", "version_affected" : "=" }, { "version_value" : "8.10.12", "version_affected" : "=" }, { "version_value" : "8.10.13", "version_affected" : "=" }, { "version_value" : "8.11.0", "version_affected" : "=" }, { "version_value" : "8.11.1", "version_affected" : "=" }, { "version_value" : "8.11.2", "version_affected" : "=" }, { "version_value" : "8.11.3", "version_affected" : "=" }, { "version_value" : "8.11.4", "version_affected" : "=" }, { "version_value" : "8.11.5", "version_affected" : "=" }, { "version_value" : "8.11.6", "version_affected" : "=" }, { "version_value" : "8.11.7", "version_affected" : "=" }, { "version_value" : "8.11.8", "version_affected" : "=" }, { "version_value" : "8.11.9", "version_affected" : "=" }, { "version_value" : "8.11.10", "version_affected" : "=" }, { "version_value" : "8.11.11", "version_affected" : "=" }, { "version_value" : "8.12.0", "version_affected" : "=" }, { "version_value" : "8.12.1", "version_affected" : "=" }, { "version_value" : "8.12.2", "version_affected" : "=" }, { "version_value" : "8.12.3", "version_affected" : "=" }, { "version_value" : "8.12.4", "version_affected" : "=" }, { "version_value" : "8.12.5", "version_affected" : "=" }, { "version_value" : "8.12.6", "version_affected" : "=" }, { "version_value" : "8.12.7", "version_affected" : "=" }, { "version_value" : "8.12.8", "version_affected" : "=" }, { "version_value" : "8.12.9", "version_affected" : "=" }, { "version_value" : "8.12.10", "version_affected" : "=" }, { "version_value" : "8.12.11", "version_affected" : "=" }, { "version_value" : "8.12.12", "version_affected" : "=" }, { "version_value" : "8.12.13", "version_affected" : "=" }, { "version_value" : "8.13.0", "version_affected" : "=" }, { "version_value" : "8.13.1", "version_affected" : "=" }, { "version_value" : "8.13.2", "version_affected" : "=" }, { "version_value" : "8.13.3", "version_affected" : "=" }, { "version_value" : "8.13.4", "version_affected" : "=" }, { "version_value" : "8.13.5", "version_affected" : "=" }, { "version_value" : "8.13.6", "version_affected" : "=" }, { "version_value" : "8.13.7", "version_affected" : "=" }, { "version_value" : "8.13.8", "version_affected" : "=" }, { "version_value" : "8.13.9", "version_affected" : "=" }, { "version_value" : "8.13.10", "version_affected" : "=" }, { "version_value" : "8.13.11", "version_affected" : "=" }, { "version_value" : "8.13.12", "version_affected" : "=" }, { "version_value" : "8.14.0", "version_affected" : "=" }, { "version_value" : "8.14.1", "version_affected" : "=" }, { "version_value" : "8.14.2", "version_affected" : "=" }, { "version_value" : "8.14.3", "version_affected" : "=" }, { "version_value" : "8.14.4", "version_affected" : "=" }, { "version_value" : "8.14.5", "version_affected" : "=" }, { "version_value" : "8.14.6", "version_affected" : "=" }, { "version_value" : "8.14.7", "version_affected" : "=" }, { "version_value" : "8.14.8", "version_affected" : "=" }, { "version_value" : "8.14.9", "version_affected" : "=" }, { "version_value" : "8.14.10", "version_affected" : "=" }, { "version_value" : "8.15.0", "version_affected" : "=" }, { "version_value" : "8.15.1", "version_affected" : "=" }, { "version_value" : "8.15.2", "version_affected" : "=" }, { "version_value" : "8.15.3", "version_affected" : "=" }, { "version_value" : "8.15.4", "version_affected" : "=" }, { "version_value" : "8.15.5", "version_affected" : "=" }, { "version_value" : "8.15.6", "version_affected" : "=" }, { "version_value" : "8.15.7", "version_affected" : "=" }, { "version_value" : "8.15.8", "version_affected" : "=" }, { "version_value" : "8.16.0", "version_affected" : "=" }, { "version_value" : "8.16.1", "version_affected" : "=" }, { "version_value" : "8.16.2", "version_affected" : "=" }, { "version_value" : "8.16.3", "version_affected" : "=" }, { "version_value" : "8.16.4", "version_affected" : "=" }, { "version_value" : "8.16.5", "version_affected" : "=" }, { "version_value" : "8.16.6", "version_affected" : "=" }, { "version_value" : "8.16.7", "version_affected" : "=" }, { "version_value" : "8.16.8", "version_affected" : "=" }, { "version_value" : "8.16.9", "version_affected" : "=" }, { "version_value" : "8.17.0", "version_affected" : "=" }, { "version_value" : "8.17.1", "version_affected" : "=" }, { "version_value" : "8.17.2", "version_affected" : "=" }, { "version_value" : "8.17.3", "version_affected" : "=" }, { "version_value" : "8.17.4", "version_affected" : "=" }, { "version_value" : "8.17.5", "version_affected" : "=" }, { "version_value" : "8.17.6", "version_affected" : "=" }, { "version_value" : "8.17.7", "version_affected" : "=" }, { "version_value" : "8.17.8", "version_affected" : "=" }, { "version_value" : "8.18.0", "version_affected" : "=" }, { "version_value" : "9.0.0", "version_affected" : "=" }, { "version_value" : "9.0.1", "version_affected" : "=" }, { "version_value" : "9.0.2", "version_affected" : "=" }, { "version_value" : "9.0.3", "version_affected" : "=" }, { "version_value" : "9.0.4", "version_affected" : "=" }, { "version_value" : "9.0.5", "version_affected" : "=" }, { "version_value" : "9.0.6", "version_affected" : "=" }, { "version_value" : "9.0.7", "version_affected" : "=" }, { "version_value" : "9.0.8", "version_affected" : "=" }, { "version_value" : "9.0.9", "version_affected" : "=" }, { "version_value" : "9.0.10", "version_affected" : "=" }, { "version_value" : "9.0.11", "version_affected" : "=" }, { "version_value" : "9.0.12", "version_affected" : "=" }, { "version_value" : "9.0.13", "version_affected" : "=" }, { "version_value" : "9.1.0", "version_affected" : "=" }, { "version_value" : "9.1.1", "version_affected" : "=" }, { "version_value" : "9.1.2", "version_affected" : "=" }, { "version_value" : "9.1.3", "version_affected" : "=" }, { "version_value" : "9.1.4", "version_affected" : "=" }, { "version_value" : "9.1.5", "version_affected" : "=" }, { "version_value" : "9.1.6", "version_affected" : "=" }, { "version_value" : "9.1.7", "version_affected" : "=" }, { "version_value" : "9.1.8", "version_affected" : "=" }, { "version_value" : "9.1.9", "version_affected" : "=" }, { "version_value" : "9.1.10", "version_affected" : "=" }, { "version_value" : "9.2.0", "version_affected" : "=" }, { "version_value" : "9.2.1", "version_affected" : "=" }, { "version_value" : "9.2.2", "version_affected" : "=" }, { "version_value" : "9.2.3", "version_affected" : "=" }, { "version_value" : "9.2.4", "version_affected" : "=" }, { "version_value" : "9.2.5", "version_affected" : "=" }, { "version_value" : "9.2.6", "version_affected" : "=" }, { "version_value" : "9.2.7", "version_affected" : "=" }, { "version_value" : "9.2.8", "version_affected" : "=" }, { "version_value" : "9.2.9", "version_affected" : "=" }, { "version_value" : "9.2.10", "version_affected" : "=" }, { "version_value" : "9.3.0", "version_affected" : "=" }, { "version_value" : "9.3.1", "version_affected" : "=" }, { "version_value" : "9.3.2", "version_affected" : "=" }, { "version_value" : "9.3.3", "version_affected" : "=" }, { "version_value" : "9.3.4", "version_affected" : "=" }, { "version_value" : "9.3.5", "version_affected" : "=" }, { "version_value" : "9.3.6", "version_affected" : "=" }, { "version_value" : "9.3.7", "version_affected" : "=" }, { "version_value" : "9.3.8", "version_affected" : "=" }, { "version_value" : "9.3.9", "version_affected" : "=" }, { "version_value" : "9.3.10", "version_affected" : "=" }, { "version_value" : "9.3.11", "version_affected" : "=" }, { "version_value" : "9.4.0", "version_affected" : "=" }, { "version_value" : "9.4.1", "version_affected" : "=" }, { "version_value" : "9.4.2", "version_affected" : "=" }, { "version_value" : "9.4.3", "version_affected" : "=" }, { "version_value" : "9.4.4", "version_affected" : "=" }, { "version_value" : "9.4.5", "version_affected" : "=" }, { "version_value" : "9.4.6", "version_affected" : "=" }, { "version_value" : "9.4.7", "version_affected" : "=" }, { "version_value" : "9.5.0", "version_affected" : "=" }, { "version_value" : "9.5.1", "version_affected" : "=" }, { "version_value" : "9.5.2", "version_affected" : "=" }, { "version_value" : "9.5.3", "version_affected" : "=" }, { "version_value" : "9.5.4", "version_affected" : "=" }, { "version_value" : "9.5.5", "version_affected" : "=" }, { "version_value" : "9.5.6", "version_affected" : "=" }, { "version_value" : "9.5.7", "version_affected" : "=" }, { "version_value" : "9.5.8", "version_affected" : "=" }, { "version_value" : "9.5.9", "version_affected" : "=" }, { "version_value" : "9.5.10", "version_affected" : "=" }, { "version_value" : "10.0.0", "version_affected" : "=" }, { "version_value" : "10.0.1", "version_affected" : "=" }, { "version_value" : "10.0.2", "version_affected" : "=" }, { "version_value" : "10.0.3", "version_affected" : "=" }, { "version_value" : "10.0.4", "version_affected" : "=" }, { "version_value" : "10.0.5", "version_affected" : "=" }, { "version_value" : "10.0.6", "version_affected" : "=" }, { "version_value" : "10.0.7", "version_affected" : "=" }, { "version_value" : "10.1.0", "version_affected" : "=" }, { "version_value" : "10.1.1", "version_affected" : "=" }, { "version_value" : "10.1.2", "version_affected" : "=" }, { "version_value" : "10.1.3", "version_affected" : "=" }, { "version_value" : "10.1.4", "version_affected" : "=" }, { "version_value" : "10.1.5", "version_affected" : "=" }, { "version_value" : "10.1.6", "version_affected" : "=" }, { "version_value" : "10.1.7", "version_affected" : "=" }, { "version_value" : "10.2.0", "version_affected" : "=" }, { "version_value" : "10.2.1", "version_affected" : "=" }, { "version_value" : "10.2.2", "version_affected" : "=" }, { "version_value" : "10.2.3", "version_affected" : "=" }, { "version_value" : "10.2.4", "version_affected" : "=" }, { "version_value" : "10.2.5", "version_affected" : "=" }, { "version_value" : "10.3.0", "version_affected" : "=" }, { "version_value" : "10.3.1", "version_affected" : "=" }, { "version_value" : "10.3.2", "version_affected" : "=" }, { "version_value" : "10.3.3", "version_affected" : "=" } ] } } ] } }, { "vendor_name" : "debian", "product" : { "product_data" : [ { "product_name" : "debian_linux", "version" : { "version_data" : [ { "version_value" : "9.0", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-22" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/", "name" : "https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://hackerone.com/reports/301432", "name" : "https://hackerone.com/reports/301432", "refsource" : "MISC", "tags" : [ "Permissions Required" ] }, { "url" : "https://www.debian.org/security/2018/dsa-4145", "name" : "DSA-4145", "refsource" : "DEBIAN", "tags" : [ "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "Gitlab Community Edition version 10.3 is vulnerable to a path traversal issue in the GitLab CI runner component resulting in remote code execution." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding" : "8.4.0", "versionEndIncluding" : "9.5.10" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding" : "8.4.0", "versionEndIncluding" : "9.5.10" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding" : "10.0.0", "versionEndIncluding" : "10.1.15" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding" : "10.0.0", "versionEndIncluding" : "10.1.5" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartExcluding" : "10.2.0", "versionEndIncluding" : "10.2.5" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding" : "10.2.0", "versionEndIncluding" : "10.2.5" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartExcluding" : "10.3.0", "versionEndIncluding" : "10.3.3" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding" : "10.3.0", "versionEndIncluding" : "10.3.3" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "HIGH", "integrityImpact" : "HIGH", "availabilityImpact" : "HIGH", "baseScore" : 8.8, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 2.8, "impactScore" : 5.9 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:S/C:P/I:P/A:P", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "SINGLE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "PARTIAL", "availabilityImpact" : "PARTIAL", "baseScore" : 6.5 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.0, "impactScore" : 6.4, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2018-03-21T20:29Z", "lastModifiedDate" : "2019-10-09T23:21Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0919", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "gitlab", "product" : { "product_data" : [ { "product_name" : "gitlab", "version" : { "version_data" : [ { "version_value" : "0.8.0", "version_affected" : "=" }, { "version_value" : "0.9.1", "version_affected" : "=" }, { "version_value" : "0.9.4", "version_affected" : "=" }, { "version_value" : "0.9.5", "version_affected" : "=" }, { "version_value" : "0.9.6", "version_affected" : "=" }, { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.2.0", "version_affected" : "=" }, { "version_value" : "1.2.1", "version_affected" : "=" }, { "version_value" : "1.2.2", "version_affected" : "=" }, { "version_value" : "2.0.0", "version_affected" : "=" }, { "version_value" : "2.1.0", "version_affected" : "=" }, { "version_value" : "2.2.0", "version_affected" : "=" }, { "version_value" : "2.3.0", "version_affected" : "=" }, { "version_value" : "2.3.1", "version_affected" : "=" }, { "version_value" : "2.4.0", "version_affected" : "=" }, { "version_value" : "2.4.1", "version_affected" : "=" }, { "version_value" : "2.4.2", "version_affected" : "=" }, { "version_value" : "2.5.0", "version_affected" : "=" }, { "version_value" : "2.6.0", "version_affected" : "=" }, { "version_value" : "2.6.1", "version_affected" : "=" }, { "version_value" : "2.6.2", "version_affected" : "=" }, { "version_value" : "2.6.3", "version_affected" : "=" }, { "version_value" : "2.7.0", "version_affected" : "=" }, { "version_value" : "2.8.0", "version_affected" : "=" }, { "version_value" : "2.8.1", "version_affected" : "=" }, { "version_value" : "2.8.2", "version_affected" : "=" }, { "version_value" : "2.9.0", "version_affected" : "=" }, { "version_value" : "2.9.1", "version_affected" : "=" }, { "version_value" : "3.0.0", "version_affected" : "=" }, { "version_value" : "3.0.1", "version_affected" : "=" }, { "version_value" : "3.0.2", "version_affected" : "=" }, { "version_value" : "3.0.3", "version_affected" : "=" }, { "version_value" : "3.1.0", "version_affected" : "=" }, { "version_value" : "4.0.0", "version_affected" : "=" }, { "version_value" : "4.1.0", "version_affected" : "=" }, { "version_value" : "4.2.0", "version_affected" : "=" }, { "version_value" : "5.0.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.2.0", "version_affected" : "=" }, { "version_value" : "5.2.1", "version_affected" : "=" }, { "version_value" : "5.3.0", "version_affected" : "=" }, { "version_value" : "5.4.0", "version_affected" : "=" }, { "version_value" : "5.4.1", "version_affected" : "=" }, { "version_value" : "5.4.2", "version_affected" : "=" }, { "version_value" : "6.0.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "6.0.2", "version_affected" : "=" }, { "version_value" : "6.1.0", "version_affected" : "=" }, { "version_value" : "6.2.0", "version_affected" : "=" }, { "version_value" : "6.2.1", "version_affected" : "=" }, { "version_value" : "6.2.2", "version_affected" : "=" }, { "version_value" : "6.2.3", "version_affected" : "=" }, { "version_value" : "6.2.4", "version_affected" : "=" }, { "version_value" : "6.3.0", "version_affected" : "=" }, { "version_value" : "6.3.1", "version_affected" : "=" }, { "version_value" : "6.4.0", "version_affected" : "=" }, { "version_value" : "6.4.1", "version_affected" : "=" }, { "version_value" : "6.4.2", "version_affected" : "=" }, { "version_value" : "6.4.3", "version_affected" : "=" }, { "version_value" : "6.5.0", "version_affected" : "=" }, { "version_value" : "6.6.0", "version_affected" : "=" }, { "version_value" : "6.6.1", "version_affected" : "=" }, { "version_value" : "6.6.2", "version_affected" : "=" }, { "version_value" : "6.6.3", "version_affected" : "=" }, { "version_value" : "6.6.4", "version_affected" : "=" }, { "version_value" : "6.6.5", "version_affected" : "=" }, { "version_value" : "6.7.0", "version_affected" : "=" }, { "version_value" : "6.7.1", "version_affected" : "=" }, { "version_value" : "6.7.2", "version_affected" : "=" }, { "version_value" : "6.7.3", "version_affected" : "=" }, { "version_value" : "6.7.4", "version_affected" : "=" }, { "version_value" : "6.7.5", "version_affected" : "=" }, { "version_value" : "6.8.0", "version_affected" : "=" }, { "version_value" : "6.8.1", "version_affected" : "=" }, { "version_value" : "6.8.2", "version_affected" : "=" }, { "version_value" : "6.9.0", "version_affected" : "=" }, { "version_value" : "6.9.1", "version_affected" : "=" }, { "version_value" : "6.9.2", "version_affected" : "=" }, { "version_value" : "6.9.3", "version_affected" : "=" }, { "version_value" : "6.9.4", "version_affected" : "=" }, { "version_value" : "7.0.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.2.0", "version_affected" : "=" }, { "version_value" : "7.2.1", "version_affected" : "=" }, { "version_value" : "7.2.2", "version_affected" : "=" }, { "version_value" : "7.2.3", "version_affected" : "=" }, { "version_value" : "7.3.0", "version_affected" : "=" }, { "version_value" : "7.3.1", "version_affected" : "=" }, { "version_value" : "7.3.2", "version_affected" : "=" }, { "version_value" : "7.3.3", "version_affected" : "=" }, { "version_value" : "7.4.0", "version_affected" : "=" }, { "version_value" : "7.4.1", "version_affected" : "=" }, { "version_value" : "7.4.2", "version_affected" : "=" }, { "version_value" : "7.4.3", "version_affected" : "=" }, { "version_value" : "7.4.4", "version_affected" : "=" }, { "version_value" : "7.4.5", "version_affected" : "=" }, { "version_value" : "7.5.0", "version_affected" : "=" }, { "version_value" : "7.5.1", "version_affected" : "=" }, { "version_value" : "7.5.2", "version_affected" : "=" }, { "version_value" : "7.5.3", "version_affected" : "=" }, { "version_value" : "7.6.0", "version_affected" : "=" }, { "version_value" : "7.6.1", "version_affected" : "=" }, { "version_value" : "7.6.2", "version_affected" : "=" }, { "version_value" : "7.7.0", "version_affected" : "=" }, { "version_value" : "7.7.1", "version_affected" : "=" }, { "version_value" : "7.7.2", "version_affected" : "=" }, { "version_value" : "7.8.0", "version_affected" : "=" }, { "version_value" : "7.8.1", "version_affected" : "=" }, { "version_value" : "7.8.2", "version_affected" : "=" }, { "version_value" : "7.8.3", "version_affected" : "=" }, { "version_value" : "7.8.4", "version_affected" : "=" }, { "version_value" : "7.9.0", "version_affected" : "=" }, { "version_value" : "7.9.1", "version_affected" : "=" }, { "version_value" : "7.9.2", "version_affected" : "=" }, { "version_value" : "7.9.3", "version_affected" : "=" }, { "version_value" : "7.9.4", "version_affected" : "=" }, { "version_value" : "7.10.0", "version_affected" : "=" }, { "version_value" : "7.10.1", "version_affected" : "=" }, { "version_value" : "7.10.2", "version_affected" : "=" }, { "version_value" : "7.10.3", "version_affected" : "=" }, { "version_value" : "7.10.4", "version_affected" : "=" }, { "version_value" : "7.10.5", "version_affected" : "=" }, { "version_value" : "7.11.0", "version_affected" : "=" }, { "version_value" : "7.11.1", "version_affected" : "=" }, { "version_value" : "7.11.2", "version_affected" : "=" }, { "version_value" : "7.11.3", "version_affected" : "=" }, { "version_value" : "7.11.4", "version_affected" : "=" }, { "version_value" : "7.12.0", "version_affected" : "=" }, { "version_value" : "7.12.1", "version_affected" : "=" }, { "version_value" : "7.12.2", "version_affected" : "=" }, { "version_value" : "7.13.0", "version_affected" : "=" }, { "version_value" : "7.13.1", "version_affected" : "=" }, { "version_value" : "7.13.2", "version_affected" : "=" }, { "version_value" : "7.13.3", "version_affected" : "=" }, { "version_value" : "7.13.4", "version_affected" : "=" }, { "version_value" : "7.13.5", "version_affected" : "=" }, { "version_value" : "7.14.0", "version_affected" : "=" }, { "version_value" : "7.14.1", "version_affected" : "=" }, { "version_value" : "7.14.2", "version_affected" : "=" }, { "version_value" : "7.14.3", "version_affected" : "=" }, { "version_value" : "8.0.0", "version_affected" : "=" }, { "version_value" : "8.0.1", "version_affected" : "=" }, { "version_value" : "8.0.2", "version_affected" : "=" }, { "version_value" : "8.0.3", "version_affected" : "=" }, { "version_value" : "8.0.4", "version_affected" : "=" }, { "version_value" : "8.0.5", "version_affected" : "=" }, { "version_value" : "8.0.6", "version_affected" : "=" }, { "version_value" : "8.1.0", "version_affected" : "=" }, { "version_value" : "8.1.1", "version_affected" : "=" }, { "version_value" : "8.1.2", "version_affected" : "=" }, { "version_value" : "8.1.3", "version_affected" : "=" }, { "version_value" : "8.1.4", "version_affected" : "=" }, { "version_value" : "8.2.0", "version_affected" : "=" }, { "version_value" : "8.2.1", "version_affected" : "=" }, { "version_value" : "8.2.2", "version_affected" : "=" }, { "version_value" : "8.2.3", "version_affected" : "=" }, { "version_value" : "8.2.4", "version_affected" : "=" }, { "version_value" : "8.2.5", "version_affected" : "=" }, { "version_value" : "8.2.6", "version_affected" : "=" }, { "version_value" : "8.3.0", "version_affected" : "=" }, { "version_value" : "8.3.1", "version_affected" : "=" }, { "version_value" : "8.3.2", "version_affected" : "=" }, { "version_value" : "8.3.3", "version_affected" : "=" }, { "version_value" : "8.3.4", "version_affected" : "=" }, { "version_value" : "8.3.5", "version_affected" : "=" }, { "version_value" : "8.3.6", "version_affected" : "=" }, { "version_value" : "8.3.7", "version_affected" : "=" }, { "version_value" : "8.3.8", "version_affected" : "=" }, { "version_value" : "8.3.9", "version_affected" : "=" }, { "version_value" : "8.3.10", "version_affected" : "=" }, { "version_value" : "8.4.0", "version_affected" : "=" }, { "version_value" : "8.4.1", "version_affected" : "=" }, { "version_value" : "8.4.2", "version_affected" : "=" }, { "version_value" : "8.4.3", "version_affected" : "=" }, { "version_value" : "8.4.4", "version_affected" : "=" }, { "version_value" : "8.4.5", "version_affected" : "=" }, { "version_value" : "8.4.6", "version_affected" : "=" }, { "version_value" : "8.4.7", "version_affected" : "=" }, { "version_value" : "8.4.8", "version_affected" : "=" }, { "version_value" : "8.4.9", "version_affected" : "=" }, { "version_value" : "8.4.10", "version_affected" : "=" }, { "version_value" : "8.4.11", "version_affected" : "=" }, { "version_value" : "8.5.0", "version_affected" : "=" }, { "version_value" : "8.5.1", "version_affected" : "=" }, { "version_value" : "8.5.2", "version_affected" : "=" }, { "version_value" : "8.5.3", "version_affected" : "=" }, { "version_value" : "8.5.4", "version_affected" : "=" }, { "version_value" : "8.5.5", "version_affected" : "=" }, { "version_value" : "8.5.6", "version_affected" : "=" }, { "version_value" : "8.5.7", "version_affected" : "=" }, { "version_value" : "8.5.8", "version_affected" : "=" }, { "version_value" : "8.5.9", "version_affected" : "=" }, { "version_value" : "8.5.10", "version_affected" : "=" }, { "version_value" : "8.5.11", "version_affected" : "=" }, { "version_value" : "8.5.12", "version_affected" : "=" }, { "version_value" : "8.5.13", "version_affected" : "=" }, { "version_value" : "8.6.0", "version_affected" : "=" }, { "version_value" : "8.6.1", "version_affected" : "=" }, { "version_value" : "8.6.2", "version_affected" : "=" }, { "version_value" : "8.6.3", "version_affected" : "=" }, { "version_value" : "8.6.4", "version_affected" : "=" }, { "version_value" : "8.6.5", "version_affected" : "=" }, { "version_value" : "8.6.6", "version_affected" : "=" }, { "version_value" : "8.6.7", "version_affected" : "=" }, { "version_value" : "8.6.8", "version_affected" : "=" }, { "version_value" : "8.6.9", "version_affected" : "=" }, { "version_value" : "8.7.0", "version_affected" : "=" }, { "version_value" : "8.7.1", "version_affected" : "=" }, { "version_value" : "8.7.2", "version_affected" : "=" }, { "version_value" : "8.7.3", "version_affected" : "=" }, { "version_value" : "8.7.4", "version_affected" : "=" }, { "version_value" : "8.7.5", "version_affected" : "=" }, { "version_value" : "8.7.6", "version_affected" : "=" }, { "version_value" : "8.7.7", "version_affected" : "=" }, { "version_value" : "8.7.8", "version_affected" : "=" }, { "version_value" : "8.7.9", "version_affected" : "=" }, { "version_value" : "8.8.0", "version_affected" : "=" }, { "version_value" : "8.8.1", "version_affected" : "=" }, { "version_value" : "8.8.2", "version_affected" : "=" }, { "version_value" : "8.8.3", "version_affected" : "=" }, { "version_value" : "8.8.4", "version_affected" : "=" }, { "version_value" : "8.8.5", "version_affected" : "=" }, { "version_value" : "8.8.6", "version_affected" : "=" }, { "version_value" : "8.8.7", "version_affected" : "=" }, { "version_value" : "8.8.8", "version_affected" : "=" }, { "version_value" : "8.8.9", "version_affected" : "=" }, { "version_value" : "8.9.0", "version_affected" : "=" }, { "version_value" : "8.9.1", "version_affected" : "=" }, { "version_value" : "8.9.2", "version_affected" : "=" }, { "version_value" : "8.9.3", "version_affected" : "=" }, { "version_value" : "8.9.4", "version_affected" : "=" }, { "version_value" : "8.9.5", "version_affected" : "=" }, { "version_value" : "8.9.6", "version_affected" : "=" }, { "version_value" : "8.9.7", "version_affected" : "=" }, { "version_value" : "8.9.8", "version_affected" : "=" }, { "version_value" : "8.9.9", "version_affected" : "=" }, { "version_value" : "8.9.10", "version_affected" : "=" }, { "version_value" : "8.9.11", "version_affected" : "=" }, { "version_value" : "8.10.0", "version_affected" : "=" }, { "version_value" : "8.10.1", "version_affected" : "=" }, { "version_value" : "8.10.2", "version_affected" : "=" }, { "version_value" : "8.10.3", "version_affected" : "=" }, { "version_value" : "8.10.4", "version_affected" : "=" }, { "version_value" : "8.10.5", "version_affected" : "=" }, { "version_value" : "8.10.6", "version_affected" : "=" }, { "version_value" : "8.10.7", "version_affected" : "=" }, { "version_value" : "8.10.8", "version_affected" : "=" }, { "version_value" : "8.10.9", "version_affected" : "=" }, { "version_value" : "8.10.10", "version_affected" : "=" }, { "version_value" : "8.10.11", "version_affected" : "=" }, { "version_value" : "8.10.12", "version_affected" : "=" }, { "version_value" : "8.10.13", "version_affected" : "=" }, { "version_value" : "8.11.0", "version_affected" : "=" }, { "version_value" : "8.11.1", "version_affected" : "=" }, { "version_value" : "8.11.2", "version_affected" : "=" }, { "version_value" : "8.11.3", "version_affected" : "=" }, { "version_value" : "8.11.4", "version_affected" : "=" }, { "version_value" : "8.11.5", "version_affected" : "=" }, { "version_value" : "8.11.6", "version_affected" : "=" }, { "version_value" : "8.11.7", "version_affected" : "=" }, { "version_value" : "8.11.8", "version_affected" : "=" }, { "version_value" : "8.11.9", "version_affected" : "=" }, { "version_value" : "8.11.10", "version_affected" : "=" }, { "version_value" : "8.11.11", "version_affected" : "=" }, { "version_value" : "8.12.0", "version_affected" : "=" }, { "version_value" : "8.12.1", "version_affected" : "=" }, { "version_value" : "8.12.2", "version_affected" : "=" }, { "version_value" : "8.12.3", "version_affected" : "=" }, { "version_value" : "8.12.4", "version_affected" : "=" }, { "version_value" : "8.12.5", "version_affected" : "=" }, { "version_value" : "8.12.6", "version_affected" : "=" }, { "version_value" : "8.12.7", "version_affected" : "=" }, { "version_value" : "8.12.8", "version_affected" : "=" }, { "version_value" : "8.12.9", "version_affected" : "=" }, { "version_value" : "8.12.10", "version_affected" : "=" }, { "version_value" : "8.12.11", "version_affected" : "=" }, { "version_value" : "8.12.12", "version_affected" : "=" }, { "version_value" : "8.12.13", "version_affected" : "=" }, { "version_value" : "8.13.0", "version_affected" : "=" }, { "version_value" : "8.13.1", "version_affected" : "=" }, { "version_value" : "8.13.2", "version_affected" : "=" }, { "version_value" : "8.13.3", "version_affected" : "=" }, { "version_value" : "8.13.4", "version_affected" : "=" }, { "version_value" : "8.13.5", "version_affected" : "=" }, { "version_value" : "8.13.6", "version_affected" : "=" }, { "version_value" : "8.13.7", "version_affected" : "=" }, { "version_value" : "8.13.8", "version_affected" : "=" }, { "version_value" : "8.13.9", "version_affected" : "=" }, { "version_value" : "8.13.10", "version_affected" : "=" }, { "version_value" : "8.13.11", "version_affected" : "=" }, { "version_value" : "8.13.12", "version_affected" : "=" }, { "version_value" : "8.14.0", "version_affected" : "=" }, { "version_value" : "8.14.1", "version_affected" : "=" }, { "version_value" : "8.14.2", "version_affected" : "=" }, { "version_value" : "8.14.3", "version_affected" : "=" }, { "version_value" : "8.14.4", "version_affected" : "=" }, { "version_value" : "8.14.5", "version_affected" : "=" }, { "version_value" : "8.14.6", "version_affected" : "=" }, { "version_value" : "8.14.7", "version_affected" : "=" }, { "version_value" : "8.14.8", "version_affected" : "=" }, { "version_value" : "8.14.9", "version_affected" : "=" }, { "version_value" : "8.14.10", "version_affected" : "=" }, { "version_value" : "8.15.0", "version_affected" : "=" }, { "version_value" : "8.15.1", "version_affected" : "=" }, { "version_value" : "8.15.2", "version_affected" : "=" }, { "version_value" : "8.15.3", "version_affected" : "=" }, { "version_value" : "8.15.4", "version_affected" : "=" }, { "version_value" : "8.15.5", "version_affected" : "=" }, { "version_value" : "8.15.6", "version_affected" : "=" }, { "version_value" : "8.15.7", "version_affected" : "=" }, { "version_value" : "8.15.8", "version_affected" : "=" }, { "version_value" : "8.16.0", "version_affected" : "=" }, { "version_value" : "8.16.1", "version_affected" : "=" }, { "version_value" : "8.16.2", "version_affected" : "=" }, { "version_value" : "8.16.3", "version_affected" : "=" }, { "version_value" : "8.16.4", "version_affected" : "=" }, { "version_value" : "8.16.5", "version_affected" : "=" }, { "version_value" : "8.16.6", "version_affected" : "=" }, { "version_value" : "8.16.7", "version_affected" : "=" }, { "version_value" : "8.16.8", "version_affected" : "=" }, { "version_value" : "8.16.9", "version_affected" : "=" }, { "version_value" : "8.17.0", "version_affected" : "=" }, { "version_value" : "8.17.1", "version_affected" : "=" }, { "version_value" : "8.17.2", "version_affected" : "=" }, { "version_value" : "8.17.3", "version_affected" : "=" }, { "version_value" : "8.17.4", "version_affected" : "=" }, { "version_value" : "8.17.5", "version_affected" : "=" }, { "version_value" : "8.17.6", "version_affected" : "=" }, { "version_value" : "8.17.7", "version_affected" : "=" }, { "version_value" : "8.17.8", "version_affected" : "=" }, { "version_value" : "8.18.0", "version_affected" : "=" }, { "version_value" : "9.0.0", "version_affected" : "=" }, { "version_value" : "9.0.1", "version_affected" : "=" }, { "version_value" : "9.0.2", "version_affected" : "=" }, { "version_value" : "9.0.3", "version_affected" : "=" }, { "version_value" : "9.0.4", "version_affected" : "=" }, { "version_value" : "9.0.5", "version_affected" : "=" }, { "version_value" : "9.0.6", "version_affected" : "=" }, { "version_value" : "9.0.7", "version_affected" : "=" }, { "version_value" : "9.0.8", "version_affected" : "=" }, { "version_value" : "9.0.9", "version_affected" : "=" }, { "version_value" : "9.0.10", "version_affected" : "=" }, { "version_value" : "9.0.11", "version_affected" : "=" }, { "version_value" : "9.0.12", "version_affected" : "=" }, { "version_value" : "9.0.13", "version_affected" : "=" }, { "version_value" : "9.1.0", "version_affected" : "=" }, { "version_value" : "9.1.1", "version_affected" : "=" }, { "version_value" : "9.1.2", "version_affected" : "=" }, { "version_value" : "9.1.3", "version_affected" : "=" }, { "version_value" : "9.1.4", "version_affected" : "=" }, { "version_value" : "9.1.5", "version_affected" : "=" }, { "version_value" : "9.1.6", "version_affected" : "=" }, { "version_value" : "9.1.7", "version_affected" : "=" }, { "version_value" : "9.1.8", "version_affected" : "=" }, { "version_value" : "9.1.9", "version_affected" : "=" }, { "version_value" : "9.1.10", "version_affected" : "=" }, { "version_value" : "9.2.0", "version_affected" : "=" }, { "version_value" : "9.2.1", "version_affected" : "=" }, { "version_value" : "9.2.2", "version_affected" : "=" }, { "version_value" : "9.2.3", "version_affected" : "=" }, { "version_value" : "9.2.4", "version_affected" : "=" }, { "version_value" : "9.2.5", "version_affected" : "=" }, { "version_value" : "9.2.6", "version_affected" : "=" }, { "version_value" : "9.2.7", "version_affected" : "=" }, { "version_value" : "9.2.8", "version_affected" : "=" }, { "version_value" : "9.2.9", "version_affected" : "=" }, { "version_value" : "9.2.10", "version_affected" : "=" }, { "version_value" : "9.3.0", "version_affected" : "=" }, { "version_value" : "9.3.1", "version_affected" : "=" }, { "version_value" : "9.3.2", "version_affected" : "=" }, { "version_value" : "9.3.3", "version_affected" : "=" }, { "version_value" : "9.3.4", "version_affected" : "=" }, { "version_value" : "9.3.5", "version_affected" : "=" }, { "version_value" : "9.3.6", "version_affected" : "=" }, { "version_value" : "9.3.7", "version_affected" : "=" }, { "version_value" : "9.3.8", "version_affected" : "=" }, { "version_value" : "9.3.9", "version_affected" : "=" }, { "version_value" : "9.3.10", "version_affected" : "=" }, { "version_value" : "9.3.11", "version_affected" : "=" }, { "version_value" : "9.4.0", "version_affected" : "=" }, { "version_value" : "9.4.1", "version_affected" : "=" }, { "version_value" : "9.4.2", "version_affected" : "=" }, { "version_value" : "9.4.3", "version_affected" : "=" }, { "version_value" : "9.4.4", "version_affected" : "=" }, { "version_value" : "9.4.5", "version_affected" : "=" }, { "version_value" : "9.4.6", "version_affected" : "=" }, { "version_value" : "9.4.7", "version_affected" : "=" }, { "version_value" : "9.5.0", "version_affected" : "=" }, { "version_value" : "9.5.1", "version_affected" : "=" }, { "version_value" : "9.5.2", "version_affected" : "=" }, { "version_value" : "9.5.3", "version_affected" : "=" }, { "version_value" : "9.5.4", "version_affected" : "=" }, { "version_value" : "9.5.5", "version_affected" : "=" }, { "version_value" : "9.5.6", "version_affected" : "=" }, { "version_value" : "9.5.7", "version_affected" : "=" }, { "version_value" : "9.5.8", "version_affected" : "=" }, { "version_value" : "9.5.9", "version_affected" : "=" }, { "version_value" : "9.5.10", "version_affected" : "=" }, { "version_value" : "9.6.0", "version_affected" : "=" }, { "version_value" : "10.0.0", "version_affected" : "=" }, { "version_value" : "10.0.1", "version_affected" : "=" }, { "version_value" : "10.0.2", "version_affected" : "=" }, { "version_value" : "10.0.3", "version_affected" : "=" }, { "version_value" : "10.0.4", "version_affected" : "=" }, { "version_value" : "10.0.5", "version_affected" : "=" }, { "version_value" : "10.0.6", "version_affected" : "=" }, { "version_value" : "10.0.7", "version_affected" : "=" }, { "version_value" : "10.1.0", "version_affected" : "=" }, { "version_value" : "10.1.1", "version_affected" : "=" }, { "version_value" : "10.1.2", "version_affected" : "=" }, { "version_value" : "10.1.3", "version_affected" : "=" }, { "version_value" : "10.1.4", "version_affected" : "=" }, { "version_value" : "10.1.5", "version_affected" : "=" }, { "version_value" : "10.2.0", "version_affected" : "=" }, { "version_value" : "10.2.1", "version_affected" : "=" }, { "version_value" : "10.2.2", "version_affected" : "=" }, { "version_value" : "10.2.3", "version_affected" : "=" }, { "version_value" : "10.2.4", "version_affected" : "=" }, { "version_value" : "10.2.5", "version_affected" : "=" }, { "version_value" : "10.3.0", "version_affected" : "=" }, { "version_value" : "10.3.1", "version_affected" : "=" }, { "version_value" : "10.3.2", "version_affected" : "=" }, { "version_value" : "10.3.3", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-306" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://hackerone.com/reports/301137", "name" : "https://hackerone.com/reports/301137", "refsource" : "MISC", "tags" : [ "Third Party Advisory" ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the GitLab import component resulting in an attacker being able to perform operations under a group in which they were previously unauthorized." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionEndExcluding" : "10.1.6" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionEndExcluding" : "10.1.6" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding" : "10.2.0", "versionEndExcluding" : "10.2.6" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding" : "10.2.0", "versionEndExcluding" : "10.2.6" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartIncluding" : "10.3.0", "versionEndExcluding" : "10.3.4" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding" : "10.3.0", "versionEndExcluding" : "10.3.4" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "NONE", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "NONE", "integrityImpact" : "HIGH", "availabilityImpact" : "NONE", "baseScore" : 7.5, "baseSeverity" : "HIGH" }, "exploitabilityScore" : 3.9, "impactScore" : 3.6 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:N/C:N/I:P/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "NONE", "confidentialityImpact" : "NONE", "integrityImpact" : "PARTIAL", "availabilityImpact" : "NONE", "baseScore" : 5.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 10.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2018-07-03T21:29Z", "lastModifiedDate" : "2018-09-04T15:25Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0920", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "gitlab", "product" : { "product_data" : [ { "product_name" : "gitlab", "version" : { "version_data" : [ { "version_value" : "8.8.0", "version_affected" : "=" }, { "version_value" : "8.8.1", "version_affected" : "=" }, { "version_value" : "8.8.2", "version_affected" : "=" }, { "version_value" : "8.8.3", "version_affected" : "=" }, { "version_value" : "8.8.4", "version_affected" : "=" }, { "version_value" : "8.8.5", "version_affected" : "=" }, { "version_value" : "8.8.6", "version_affected" : "=" }, { "version_value" : "8.8.7", "version_affected" : "=" }, { "version_value" : "8.8.8", "version_affected" : "=" }, { "version_value" : "8.8.9", "version_affected" : "=" }, { "version_value" : "8.9.0", "version_affected" : "=" }, { "version_value" : "8.9.1", "version_affected" : "=" }, { "version_value" : "8.9.2", "version_affected" : "=" }, { "version_value" : "8.9.3", "version_affected" : "=" }, { "version_value" : "8.9.4", "version_affected" : "=" }, { "version_value" : "8.9.5", "version_affected" : "=" }, { "version_value" : "8.9.6", "version_affected" : "=" }, { "version_value" : "8.9.7", "version_affected" : "=" }, { "version_value" : "8.9.8", "version_affected" : "=" }, { "version_value" : "8.9.9", "version_affected" : "=" }, { "version_value" : "8.9.10", "version_affected" : "=" }, { "version_value" : "8.9.11", "version_affected" : "=" }, { "version_value" : "8.10.0", "version_affected" : "=" }, { "version_value" : "8.10.1", "version_affected" : "=" }, { "version_value" : "8.10.2", "version_affected" : "=" }, { "version_value" : "8.10.3", "version_affected" : "=" }, { "version_value" : "8.10.4", "version_affected" : "=" }, { "version_value" : "8.10.5", "version_affected" : "=" }, { "version_value" : "8.10.6", "version_affected" : "=" }, { "version_value" : "8.10.7", "version_affected" : "=" }, { "version_value" : "8.10.8", "version_affected" : "=" }, { "version_value" : "8.10.9", "version_affected" : "=" }, { "version_value" : "8.10.10", "version_affected" : "=" }, { "version_value" : "8.10.11", "version_affected" : "=" }, { "version_value" : "8.10.12", "version_affected" : "=" }, { "version_value" : "8.10.13", "version_affected" : "=" }, { "version_value" : "8.11.0", "version_affected" : "=" }, { "version_value" : "8.11.1", "version_affected" : "=" }, { "version_value" : "8.11.2", "version_affected" : "=" }, { "version_value" : "8.11.3", "version_affected" : "=" }, { "version_value" : "8.11.4", "version_affected" : "=" }, { "version_value" : "8.11.5", "version_affected" : "=" }, { "version_value" : "8.11.6", "version_affected" : "=" }, { "version_value" : "8.11.7", "version_affected" : "=" }, { "version_value" : "8.11.8", "version_affected" : "=" }, { "version_value" : "8.11.9", "version_affected" : "=" }, { "version_value" : "8.11.10", "version_affected" : "=" }, { "version_value" : "8.11.11", "version_affected" : "=" }, { "version_value" : "8.12.0", "version_affected" : "=" }, { "version_value" : "8.12.1", "version_affected" : "=" }, { "version_value" : "8.12.2", "version_affected" : "=" }, { "version_value" : "8.12.3", "version_affected" : "=" }, { "version_value" : "8.12.4", "version_affected" : "=" }, { "version_value" : "8.12.5", "version_affected" : "=" }, { "version_value" : "8.12.6", "version_affected" : "=" }, { "version_value" : "8.12.7", "version_affected" : "=" }, { "version_value" : "8.12.8", "version_affected" : "=" }, { "version_value" : "8.12.9", "version_affected" : "=" }, { "version_value" : "8.12.10", "version_affected" : "=" }, { "version_value" : "8.12.11", "version_affected" : "=" }, { "version_value" : "8.12.12", "version_affected" : "=" }, { "version_value" : "8.12.13", "version_affected" : "=" }, { "version_value" : "8.13.0", "version_affected" : "=" }, { "version_value" : "8.13.1", "version_affected" : "=" }, { "version_value" : "8.13.2", "version_affected" : "=" }, { "version_value" : "8.13.3", "version_affected" : "=" }, { "version_value" : "8.13.4", "version_affected" : "=" }, { "version_value" : "8.13.5", "version_affected" : "=" }, { "version_value" : "8.13.6", "version_affected" : "=" }, { "version_value" : "8.13.7", "version_affected" : "=" }, { "version_value" : "8.13.8", "version_affected" : "=" }, { "version_value" : "8.13.9", "version_affected" : "=" }, { "version_value" : "8.13.10", "version_affected" : "=" }, { "version_value" : "8.13.11", "version_affected" : "=" }, { "version_value" : "8.13.12", "version_affected" : "=" }, { "version_value" : "8.14.0", "version_affected" : "=" }, { "version_value" : "8.14.1", "version_affected" : "=" }, { "version_value" : "8.14.2", "version_affected" : "=" }, { "version_value" : "8.14.3", "version_affected" : "=" }, { "version_value" : "8.14.4", "version_affected" : "=" }, { "version_value" : "8.14.5", "version_affected" : "=" }, { "version_value" : "8.14.6", "version_affected" : "=" }, { "version_value" : "8.14.7", "version_affected" : "=" }, { "version_value" : "8.14.8", "version_affected" : "=" }, { "version_value" : "8.14.9", "version_affected" : "=" }, { "version_value" : "8.14.10", "version_affected" : "=" }, { "version_value" : "8.15.0", "version_affected" : "=" }, { "version_value" : "8.15.1", "version_affected" : "=" }, { "version_value" : "8.15.2", "version_affected" : "=" }, { "version_value" : "8.15.3", "version_affected" : "=" }, { "version_value" : "8.15.4", "version_affected" : "=" }, { "version_value" : "8.15.5", "version_affected" : "=" }, { "version_value" : "8.15.6", "version_affected" : "=" }, { "version_value" : "8.15.7", "version_affected" : "=" }, { "version_value" : "8.15.8", "version_affected" : "=" }, { "version_value" : "8.16.0", "version_affected" : "=" }, { "version_value" : "8.16.1", "version_affected" : "=" }, { "version_value" : "8.16.2", "version_affected" : "=" }, { "version_value" : "8.16.3", "version_affected" : "=" }, { "version_value" : "8.16.4", "version_affected" : "=" }, { "version_value" : "8.16.5", "version_affected" : "=" }, { "version_value" : "8.16.6", "version_affected" : "=" }, { "version_value" : "8.16.7", "version_affected" : "=" }, { "version_value" : "8.16.8", "version_affected" : "=" }, { "version_value" : "8.16.9", "version_affected" : "=" }, { "version_value" : "8.17.0", "version_affected" : "=" }, { "version_value" : "8.17.1", "version_affected" : "=" }, { "version_value" : "8.17.2", "version_affected" : "=" }, { "version_value" : "8.17.3", "version_affected" : "=" }, { "version_value" : "8.17.4", "version_affected" : "=" }, { "version_value" : "8.17.5", "version_affected" : "=" }, { "version_value" : "8.17.6", "version_affected" : "=" }, { "version_value" : "8.17.7", "version_affected" : "=" }, { "version_value" : "8.17.8", "version_affected" : "=" }, { "version_value" : "8.18.0", "version_affected" : "=" }, { "version_value" : "9.0.0", "version_affected" : "=" }, { "version_value" : "9.0.1", "version_affected" : "=" }, { "version_value" : "9.0.2", "version_affected" : "=" }, { "version_value" : "9.0.3", "version_affected" : "=" }, { "version_value" : "9.0.4", "version_affected" : "=" }, { "version_value" : "9.0.5", "version_affected" : "=" }, { "version_value" : "9.0.6", "version_affected" : "=" }, { "version_value" : "9.0.7", "version_affected" : "=" }, { "version_value" : "9.0.8", "version_affected" : "=" }, { "version_value" : "9.0.9", "version_affected" : "=" }, { "version_value" : "9.0.10", "version_affected" : "=" }, { "version_value" : "9.0.11", "version_affected" : "=" }, { "version_value" : "9.0.12", "version_affected" : "=" }, { "version_value" : "9.0.13", "version_affected" : "=" }, { "version_value" : "9.1.0", "version_affected" : "=" }, { "version_value" : "9.1.1", "version_affected" : "=" }, { "version_value" : "9.1.2", "version_affected" : "=" }, { "version_value" : "9.1.3", "version_affected" : "=" }, { "version_value" : "9.1.4", "version_affected" : "=" }, { "version_value" : "9.1.5", "version_affected" : "=" }, { "version_value" : "9.1.6", "version_affected" : "=" }, { "version_value" : "9.1.7", "version_affected" : "=" }, { "version_value" : "9.1.8", "version_affected" : "=" }, { "version_value" : "9.1.9", "version_affected" : "=" }, { "version_value" : "9.1.10", "version_affected" : "=" }, { "version_value" : "9.2.0", "version_affected" : "=" }, { "version_value" : "9.2.1", "version_affected" : "=" }, { "version_value" : "9.2.2", "version_affected" : "=" }, { "version_value" : "9.2.3", "version_affected" : "=" }, { "version_value" : "9.2.4", "version_affected" : "=" }, { "version_value" : "9.2.5", "version_affected" : "=" }, { "version_value" : "9.2.6", "version_affected" : "=" }, { "version_value" : "9.2.7", "version_affected" : "=" }, { "version_value" : "9.2.8", "version_affected" : "=" }, { "version_value" : "9.2.9", "version_affected" : "=" }, { "version_value" : "9.2.10", "version_affected" : "=" }, { "version_value" : "9.3.0", "version_affected" : "=" }, { "version_value" : "9.3.1", "version_affected" : "=" }, { "version_value" : "9.3.2", "version_affected" : "=" }, { "version_value" : "9.3.3", "version_affected" : "=" }, { "version_value" : "9.3.4", "version_affected" : "=" }, { "version_value" : "9.3.5", "version_affected" : "=" }, { "version_value" : "9.3.6", "version_affected" : "=" }, { "version_value" : "9.3.7", "version_affected" : "=" }, { "version_value" : "9.3.8", "version_affected" : "=" }, { "version_value" : "9.3.9", "version_affected" : "=" }, { "version_value" : "9.3.10", "version_affected" : "=" }, { "version_value" : "9.3.11", "version_affected" : "=" }, { "version_value" : "9.4.0", "version_affected" : "=" }, { "version_value" : "9.4.1", "version_affected" : "=" }, { "version_value" : "9.4.2", "version_affected" : "=" }, { "version_value" : "9.4.3", "version_affected" : "=" }, { "version_value" : "9.4.4", "version_affected" : "=" }, { "version_value" : "9.4.5", "version_affected" : "=" }, { "version_value" : "9.4.6", "version_affected" : "=" }, { "version_value" : "9.4.7", "version_affected" : "=" }, { "version_value" : "9.5.0", "version_affected" : "=" }, { "version_value" : "9.5.1", "version_affected" : "=" }, { "version_value" : "9.5.2", "version_affected" : "=" }, { "version_value" : "9.5.3", "version_affected" : "=" }, { "version_value" : "9.5.4", "version_affected" : "=" }, { "version_value" : "9.5.5", "version_affected" : "=" }, { "version_value" : "9.5.6", "version_affected" : "=" }, { "version_value" : "9.5.7", "version_affected" : "=" }, { "version_value" : "9.5.8", "version_affected" : "=" }, { "version_value" : "9.5.9", "version_affected" : "=" }, { "version_value" : "9.5.10", "version_affected" : "=" }, { "version_value" : "9.6.0", "version_affected" : "=" }, { "version_value" : "10.0.0", "version_affected" : "=" }, { "version_value" : "10.0.1", "version_affected" : "=" }, { "version_value" : "10.0.2", "version_affected" : "=" }, { "version_value" : "10.0.3", "version_affected" : "=" }, { "version_value" : "10.0.4", "version_affected" : "=" }, { "version_value" : "10.0.5", "version_affected" : "=" }, { "version_value" : "10.0.6", "version_affected" : "=" }, { "version_value" : "10.0.7", "version_affected" : "=" }, { "version_value" : "10.1.0", "version_affected" : "=" }, { "version_value" : "10.1.1", "version_affected" : "=" }, { "version_value" : "10.1.2", "version_affected" : "=" }, { "version_value" : "10.1.3", "version_affected" : "=" }, { "version_value" : "10.1.4", "version_affected" : "=" }, { "version_value" : "10.1.5", "version_affected" : "=" }, { "version_value" : "10.2.0", "version_affected" : "=" }, { "version_value" : "10.2.1", "version_affected" : "=" }, { "version_value" : "10.2.2", "version_affected" : "=" }, { "version_value" : "10.2.3", "version_affected" : "=" }, { "version_value" : "10.2.4", "version_affected" : "=" }, { "version_value" : "10.2.5", "version_affected" : "=" }, { "version_value" : "10.3.0", "version_affected" : "=" }, { "version_value" : "10.3.1", "version_affected" : "=" }, { "version_value" : "10.3.2", "version_affected" : "=" }, { "version_value" : "10.3.3", "version_affected" : "=" } ] } } ] } } ] } }, "problemtype" : { "problemtype_data" : [ { "description" : [ { "lang" : "en", "value" : "CWE-863" } ] } ] }, "references" : { "reference_data" : [ { "url" : "https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/", "name" : "https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/", "refsource" : "CONFIRM", "tags" : [ "Vendor Advisory" ] }, { "url" : "https://hackerone.com/reports/301336", "name" : "https://hackerone.com/reports/301336", "refsource" : "MISC", "tags" : [ "Permissions Required" ] }, { "url" : "https://www.debian.org/security/2018/dsa-4206", "name" : "DSA-4206", "refsource" : "DEBIAN", "tags" : [ ] } ] }, "description" : { "description_data" : [ { "lang" : "en", "value" : "GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the Projects::MergeRequests::CreationsController component resulting in an attacker to see every project name and their respective namespace on a GitLab instance." } ] } }, "configurations" : { "CVE_data_version" : "4.0", "nodes" : [ { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartExcluding" : "8.8.0", "versionEndIncluding" : "10.1.5" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding" : "8.8.0", "versionEndIncluding" : "10.1.5" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartExcluding" : "10.2.0", "versionEndIncluding" : "10.2.5" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding" : "10.2.0", "versionEndIncluding" : "10.2.5" } ] }, { "operator" : "OR", "cpe_match" : [ { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "versionStartExcluding" : "10.3.0", "versionEndIncluding" : "10.3.3" }, { "vulnerable" : true, "cpe23Uri" : "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "versionStartIncluding" : "10.3.0", "versionEndIncluding" : "10.3.3" } ] } ] }, "impact" : { "baseMetricV3" : { "cvssV3" : { "version" : "3.0", "vectorString" : "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "attackVector" : "NETWORK", "attackComplexity" : "LOW", "privilegesRequired" : "LOW", "userInteraction" : "NONE", "scope" : "UNCHANGED", "confidentialityImpact" : "LOW", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.3, "baseSeverity" : "MEDIUM" }, "exploitabilityScore" : 2.8, "impactScore" : 1.4 }, "baseMetricV2" : { "cvssV2" : { "version" : "2.0", "vectorString" : "AV:N/AC:L/Au:S/C:P/I:N/A:N", "accessVector" : "NETWORK", "accessComplexity" : "LOW", "authentication" : "SINGLE", "confidentialityImpact" : "PARTIAL", "integrityImpact" : "NONE", "availabilityImpact" : "NONE", "baseScore" : 4.0 }, "severity" : "MEDIUM", "exploitabilityScore" : 8.0, "impactScore" : 2.9, "obtainAllPrivilege" : false, "obtainUserPrivilege" : false, "obtainOtherPrivilege" : false, "userInteractionRequired" : false } }, "publishedDate" : "2018-03-22T15:29Z", "lastModifiedDate" : "2019-10-03T00:03Z" }, { "cve" : { "data_type" : "CVE", "data_format" : "MITRE", "data_version" : "4.0", "CVE_data_meta" : { "ID" : "CVE-2017-0921", "ASSIGNER" : "cve@mitre.org" }, "affects" : { "vendor" : { "vendor_data" : [ { "vendor_name" : "gitlab", "product" : { "product_data" : [ { "product_name" : "gitlab", "version" : { "version_data" : [ { "version_value" : "0.8.0", "version_affected" : "=" }, { "version_value" : "0.9.1", "version_affected" : "=" }, { "version_value" : "0.9.4", "version_affected" : "=" }, { "version_value" : "0.9.5", "version_affected" : "=" }, { "version_value" : "0.9.6", "version_affected" : "=" }, { "version_value" : "1.0.0", "version_affected" : "=" }, { "version_value" : "1.0.1", "version_affected" : "=" }, { "version_value" : "1.0.2", "version_affected" : "=" }, { "version_value" : "1.1.0", "version_affected" : "=" }, { "version_value" : "1.2.0", "version_affected" : "=" }, { "version_value" : "1.2.1", "version_affected" : "=" }, { "version_value" : "1.2.2", "version_affected" : "=" }, { "version_value" : "2.0.0", "version_affected" : "=" }, { "version_value" : "2.1.0", "version_affected" : "=" }, { "version_value" : "2.2.0", "version_affected" : "=" }, { "version_value" : "2.3.0", "version_affected" : "=" }, { "version_value" : "2.3.1", "version_affected" : "=" }, { "version_value" : "2.4.0", "version_affected" : "=" }, { "version_value" : "2.4.1", "version_affected" : "=" }, { "version_value" : "2.4.2", "version_affected" : "=" }, { "version_value" : "2.5.0", "version_affected" : "=" }, { "version_value" : "2.6.0", "version_affected" : "=" }, { "version_value" : "2.6.1", "version_affected" : "=" }, { "version_value" : "2.6.2", "version_affected" : "=" }, { "version_value" : "2.6.3", "version_affected" : "=" }, { "version_value" : "2.7.0", "version_affected" : "=" }, { "version_value" : "2.8.0", "version_affected" : "=" }, { "version_value" : "2.8.1", "version_affected" : "=" }, { "version_value" : "2.8.2", "version_affected" : "=" }, { "version_value" : "2.9.0", "version_affected" : "=" }, { "version_value" : "2.9.1", "version_affected" : "=" }, { "version_value" : "3.0.0", "version_affected" : "=" }, { "version_value" : "3.0.1", "version_affected" : "=" }, { "version_value" : "3.0.2", "version_affected" : "=" }, { "version_value" : "3.0.3", "version_affected" : "=" }, { "version_value" : "3.1.0", "version_affected" : "=" }, { "version_value" : "4.0.0", "version_affected" : "=" }, { "version_value" : "4.1.0", "version_affected" : "=" }, { "version_value" : "4.2.0", "version_affected" : "=" }, { "version_value" : "5.0.0", "version_affected" : "=" }, { "version_value" : "5.0.1", "version_affected" : "=" }, { "version_value" : "5.1.0", "version_affected" : "=" }, { "version_value" : "5.2.0", "version_affected" : "=" }, { "version_value" : "5.2.1", "version_affected" : "=" }, { "version_value" : "5.3.0", "version_affected" : "=" }, { "version_value" : "5.4.0", "version_affected" : "=" }, { "version_value" : "5.4.1", "version_affected" : "=" }, { "version_value" : "5.4.2", "version_affected" : "=" }, { "version_value" : "6.0.0", "version_affected" : "=" }, { "version_value" : "6.0.1", "version_affected" : "=" }, { "version_value" : "6.0.2", "version_affected" : "=" }, { "version_value" : "6.1.0", "version_affected" : "=" }, { "version_value" : "6.2.0", "version_affected" : "=" }, { "version_value" : "6.2.1", "version_affected" : "=" }, { "version_value" : "6.2.2", "version_affected" : "=" }, { "version_value" : "6.2.3", "version_affected" : "=" }, { "version_value" : "6.2.4", "version_affected" : "=" }, { "version_value" : "6.3.0", "version_affected" : "=" }, { "version_value" : "6.3.1", "version_affected" : "=" }, { "version_value" : "6.4.0", "version_affected" : "=" }, { "version_value" : "6.4.1", "version_affected" : "=" }, { "version_value" : "6.4.2", "version_affected" : "=" }, { "version_value" : "6.4.3", "version_affected" : "=" }, { "version_value" : "6.5.0", "version_affected" : "=" }, { "version_value" : "6.6.0", "version_affected" : "=" }, { "version_value" : "6.6.1", "version_affected" : "=" }, { "version_value" : "6.6.2", "version_affected" : "=" }, { "version_value" : "6.6.3", "version_affected" : "=" }, { "version_value" : "6.6.4", "version_affected" : "=" }, { "version_value" : "6.6.5", "version_affected" : "=" }, { "version_value" : "6.7.0", "version_affected" : "=" }, { "version_value" : "6.7.1", "version_affected" : "=" }, { "version_value" : "6.7.2", "version_affected" : "=" }, { "version_value" : "6.7.3", "version_affected" : "=" }, { "version_value" : "6.7.4", "version_affected" : "=" }, { "version_value" : "6.7.5", "version_affected" : "=" }, { "version_value" : "6.8.0", "version_affected" : "=" }, { "version_value" : "6.8.1", "version_affected" : "=" }, { "version_value" : "6.8.2", "version_affected" : "=" }, { "version_value" : "6.9.0", "version_affected" : "=" }, { "version_value" : "6.9.1", "version_affected" : "=" }, { "version_value" : "6.9.2", "version_affected" : "=" }, { "version_value" : "6.9.3", "version_affected" : "=" }, { "version_value" : "6.9.4", "version_affected" : "=" }, { "version_value" : "7.0.0", "version_affected" : "=" }, { "version_value" : "7.1.0", "version_affected" : "=" }, { "version_value" : "7.1.1", "version_affected" : "=" }, { "version_value" : "7.2.0", "version_affected" : "=" }, { "version_value" : "7.2.1", "version_affected" : "=" }, { "version_value" : "7.2.2", "version_affected" : "=" }, { "version_value" : "7.2.3", "version_affected" : "=" }, { "version_value" : "7.3.0", "version_affected" : "=" }, { "version_value" : "7.3.1", "version_affected" : "=" }, { "version_value" : "7.3.2", "version_affected" : "=" }, { "version_value" : "7.3.3", "version_affected" : "=" }, { "version_value" : "7.4.0", "version_affected" : "=" }, { "version_value" : "7.4.1", "version_affected" : "=" }, { "version_value" : "7.4.2", "version_affected" : "=" }, { "version_value" : "7.4.3", "version_affected" : "=" }, { "version_value" : "7.4.4", "version_affected" : "=" }, { "version_value" : "7.4.5", "version_affected" : "=" }, { "version_value" : "7.5.0", "version_affected" : "=" }, { "version_value" : "7.5.1", "version_affected" : "=" }, { "version_value" : "7.5.2", "version_affected" : "=" }, { "version_value" : "7.5.3", "version_affected" : "=" }, { "version_value" : "7.6.0", "version_affected" : "=" }, { "version_value" : "7.6.1", "version_affected" : "=" }, { "version_value" : "7.6.2", "version_affected" : "=" }, { "version_value" : "7.7.0", "version_affected" : "=" }, { "version_value" : "7.7.1", "version_affected" : "=" }, { "version_value" : "7.7.2", "version_affected" : "=" }, { "version_value" : "7.8.0", "version_affected" : "=" }, { "version_value" : "7.8.1", "version_affected" : "=" }, { "version_value" : "7.8.2", "version_affected" : "=" }, { "version_value" : "7.8.3", "version_affected" : "=" }, { "version_value" : "7.8.4", "version_affected" : "=" }, { "version_value" : "7.9.0", "version_affected" : "=" }, { "version_value" : "7.9.1", "version_affected" : "=" }, { "version_value" : "7.9.2", "version_affected" : "=" }, { "version_value" : "7.9.3", "version_affected" : "=" }, { "version_value" : "7.9.4", "version_affected" : "=" }, { "version_value" : "7.10.0", "version_affected" : "=" }, { "version_value" : "7.10.1", "version_affected" : "=" }, { "version_value" : "7.10.2", "version_affected" : "=" }, { "version_value" : "7.10.3", "version_affected" : "=" }, { "version_value" : "7.10.4", "version_affected" : "=" }, { "version_value" : "7.10.5", "version_affected" : "=" }, { "version_value" : "7.11.0", "version_affected" : "=" }, { "version_value" : "7.11.1", "version_affected" : "=" }, { "version_value" : "7.11.2", "version_affected" : "=" }, { "version_value" : "7.11.3", "version_affected" : "=" }, { "version_value" : "7.11.4", "version_affected" : "=" }, { "version_value" : "7.12.0", "version_affected" : "=" }, { "version_value" : "7.12.1", "version_affected" : "=" }, { "version_value" : "7.12.2", "version_affected" : "=" }, { "version_value" : "7.13.0", "version_affected" : "=" }, { "version_value" : "7.13.1", "version_affected" : "=" }, { "version_value" : "7.13.2", "version_affected" : "=" }, { "version_value" : "7.13.3", "version_affected" : "=" }, { "version_value" : "7.13.4", "version_affected" : "=" }, { "version_value" : "7.13.5", "version_affected" : "=" }, { "version_value" : "7.14.0", "version_affected" : "=" }, { "version_value" : "7.14.1", "version_affected" : "=" }, { "version_value" : "7.14.2", "version_affected" : "=" }, { "version_value" : "7.14.3", "version_affected" : "=" }, { "version_value" : "8.0.0", "version_affected" : "=" }, { "version_value" : "8.0.1", "version_affected" : "=" }, { "version_value" : "8.0.2", "version_affected" : "=" }, { "version_value" : "8.0.3", "version_affected" : "=" }, { "version_value" : "8.0.4", "version_affected" : "=" }, { "version_value" : "8.0.5", "version_affected" : "=" }, { "version_value" : "8.0.6", "version_affected" : "=" }, { "version_value" : "8.1.0", "version_affected" : "=" }, { "version_value" : "8.1.1", "version_affected" : "=" }, { "version_value" : "8.1.2", "version_affected" : "=" }, { "version_value" : "8.1.3", "version_affected" : "=" }, { "version_value" : "8.1.4", "version_affected" : "=" }, { "version_value" : "8.2.0", "version_affected" : "=" }, { "version_value" : "8.2.1", "version_affected" : "=" }, { "version_value" : "8.2.2", "version_affected" : "=" }, { "version_value" : "8.2.3", "version_affected" : "=" }, { "version_value" : "8.2.4", "version_affected" : "=" }, { "version_value" : "8.2.5", "version_affected" : "=" }, { "version_value" : "8.2.6", "version_affected" : "=" }, { "version_value" : "8.3.0", "version_affected" : "=" }, { "version_value" : "8.3.1", "version_affected" : "=" }, { "version_value" : "8.3.2", "version_affected" : "=" }, { "version_value" : "8.3.3", "version_affected" : "=" }, { "version_value" : "8.3.4", "version_affected" : "=" }, { "version_value" : "8.3.5", "version_affected" : "=" }, { "version_value" : "8.3.6", "version_affected" : "=" }, { "version_value" : "8.3.7", "version_affected" : "=" }, { "version_value" : "8.3.8", "version_affected" : "=" }, { "version_value" : "8.3.9", "version_affected" : "=" }, { "version_value" : "8.3.10", "version_affected" : "=" }, { "version_value" : "8.4.0", "version_affected" : "=" }, { "version_value" : "8.4.1", "version_affected" : "=" }, { "version_value" : "8.4.2", "version_affected" : "=" }, { "version_value" : "8.4.3", "version_affected" : "=" }, { "version_value" : "8.4.4", "version_affected" : "=" }, { "version_value" : "8.4.5", "version_affected" : "=" }, { "version_value" : "8.4.6", "version_affected" : "=" }, { "version_value" : "8.4.7", "version_affected" : "=" }, { "version_value" : "8.4.8", "version_affected" : "=" }, { "version_value" : "8.4.9", "version_affected" : "=" }, { "version_value" : "8.4.10", "version_affected" : "=" }, { "version_value" : "8.4.11", "version_affected" : "=" }, { "version_value" : "8.5.0", "version_affected" : "=" }, { "version_value" : "8.5.1", "version_affected" : "=" }, { "version_value" : "8.5.2", "version_affected" : "=" }, { "version_value" : "8.5.3", "version_affected" : "=" }, { "version_value" : "8.5.4", "version_affected" : "=" }, { "version_value" : "8.5.5", "version_affected" : "=" }, { "version_value" : "8.5.6", "version_affected" : "=" }, { "version_value" : "8.5.7", "version_affected" : "=" }, { "version_value" : "8.5.8", "version_affected" : "=" }, { "version_value" : "8.5.9", "version_affected" : "=" }, { "version_value" : "8.5.10", "version_affected" : "=" }, { "version_value" : "8.5.11", "version_affected" : "=" }, { "version_value" : "8.5.12", "version_affected" : "=" }, { "version_value" : "8.5.13", "version_affected" : "=" }, { "version_value" : "8.6.0", "version_affected" : "=" }, { "version_value" : "8.6.1", "version_affected" : "=" }, { "version_value" : "8.6.2", "version_affected" : "=" }, { "version_value" : "8.6.3", "version_affected" : "=" }, { "version_value" : "8.6.4", "version_affected" : "=" }, { "version_value" : "8.6.5", "version_affected" : "=" }, { "version_value" : "8.6.6", "version_affected" : "=" }, { "version_value" : "8.6.7", "version_affected" : "=" }, { "version_value" : "8.6.8", "version_affected" : "=" }, { "version_value" : "8.6.9", "version_affected" : "=" }, { "version_value" : "8.7.0", "version_affected" : "=" }, { "version_value" : "8.7.1", "version_affected" : "=" }, { "version_value" : "8.7.2", "version_affected" : "=" }, { "version_value" : "8.7.3", "version_affected" : "=" }, { "version_value" : "8.7.4", "version_affected" : "=" }, { "version_value" : "8.7.5", "version_affected" : "=" }, { "version_value" : "8.7.6", "version_affected" : "=" }, { "version_value" : "8.7.7", "version_affected" : "=" }, { "version_value" : "8.7.8", "version_affected" : "=" }, { "version_value" : "8.7.9", "version_affected" : "=" }, { "version_value" : "8.8.0", "version_affected" : "=" }, { "version_value" : "8.8.1", "version_affected" : "=" }, { "version_value" : "8.8.2", "version_affected" : "=" }, { "version_value" : "8.8.3", "version_affected" : "=" }, { "version_value" : "8.8.4", "version_affected" : "=" }, { "version_value" : "8.8.5", "version_affected" : "=" }, { "version_value" : "8.8.6", "version_affected" : "=" }, { "version_value" : "8.8.7", "version_affected" : "=" }, { "version_value" : "8.8.8", "version_affected" : "=" }, { "version_value" : "8.8.9", "version_affected" : "=" }, { "version_value" : "8.9.0", "version_affected" : "=" }, { "version_value" : "8.9.1", "version_affected" : "=" }, { "versi