CVE-2017-1000087

GitHub Branch Source provides a list of applicable credential IDs to allow users configuring a job to select the one they'd like to use. This functionality did not check permissions, allowing any user with Overall/Read permission to get a list of valid credentials IDs. Those could be used as part...

CVE-2017-1000091

The CVE-2017-1000091 entry concerns the Jenkins GitHub Branch Source Plugin, where form validation against a user-specified GitHub API URL allowed unauthorized credential access. The root cause is improper permission checks that let any user with Overall/Read access connect to a web server and se...

CVE-2017-1000087

The Connected documents confirm a vulnerability in the Jenkins GitHub Branch Source Plugin: any user with Overall/Read permission could enumerate credential IDs by accessing the job context, due to missing permission checks. The issue enables potential credential disclosure and could facilitate c...

CVE-2017-1000091

GitHub Branch Source Plugin connects to a user-specified GitHub API URL e.g. GitHub Enterprise as part of form validation and completion e.g. to verify Scan Credentials are correct. This functionality improperly checked permissions, allowing any user with Overall/Read access to Jenkins to connect...

CVE-2017-14691

STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to "Data from Faulting Address controls Branch Selection starting at ntdll773a0000!RtlAddAccessAllowedAce+0x000000000000027a."...

CVE-2017-14564

STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to "Data from Faulting Address controls Branch Selection starting at STDUXPSFile!DllUnregisterServer+0x0000000000028657."...

CVE-2017-14578

IrfanView 4.44 - 32bit allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .ani file, related to "Data from Faulting Address controls Branch Selection starting at ntdll77130000!RtlpCoalesceFreeBlocks+0x00000000000004b4."...

CVE-2017-14560

STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to "Data from Faulting Address controls Branch Selection starting at STDUXPSFile!DllUnregisterServer+0x0000000000005bd2."...

CVE-2017-14545

STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .epub file, related to "Data from Faulting Address controls Branch Selection starting at STDUEPubFile!DllUnregisterServer+0x0000000000010332."...

CVE-2017-14545

STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .epub file, related to "Data from Faulting Address controls Branch Selection starting at STDUEPubFile!DllUnregisterServer+0x0000000000010332."...

CVE-2017-14564

STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file, related to "Data from Faulting Address controls Branch Selection starting at STDUXPSFile!DllUnregisterServer+0x0000000000028657."...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference. In Poppler 0.59.0, a NULL Pointer Dereference exists in the XRef::parseEntry function in XRef.cc via a crafted PDF document. Remediation A fix was pushed into the master branch but not yet published. References...

Design/Logic Flaw

STDU Viewer 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to "Data from Faulting Address controls Branch Selection starting at ntdll77400000!TpAllocCleanupGroup+0x0000000000000402."...

Scientific Linux Security Update : git on SL7.x x86_64 (20170801)

Security Fixes : - It was found that the git-prompt.sh script shipped with git failed to correctly handle branch names containing special characters. A specially crafted git repository could use this flaw to execute arbitrary commands if a user working with the repository configured their shell t...

libtasn1 security, bug fix, and enhancement update

4.10-1 - Updated to the 4.x branch 1360639...

Fedora 25 : qt5-qtwebkit (2017-c844713925)

Qt5WebKit update to the new, maintained 'annulen branch'. Drop-in replacement for the old unmaintained QtWebKit. ---- Update to annulen-branch of qt5-qtwebkit, which contains a lot of security fixes. Drop-in replacement for the old unmaintained qt5-qtwebkit Note that Tenable Network Security has...

git security and bug fix update

1.8.3.1-11 - dissalow repo names beginning with dash Resolves: CVE-2017-8386 -1.8.3.1-10 - do not put unsanitized branch names in Resolves: CVE-2014-9938 -1.8.3.1-9 - add control of GSSAPI credential delegation to enable HTTPS-SSO authentication Resolves: 1369173 1.8.3.1-8 - remove needles check ...

git: git-prompt.sh does not sanitize branch names in $PS1

It was found that the git-prompt.sh script shipped with git failed to correctly handle branch names containing special characters. A specially crafted git repository could use this flaw to execute arbitrary commands if a user working with the repository configured their shell to include repositor...

CVE-2017-10767

XnView Classic for Windows Version 2.40 might allow attackers to cause a denial of service or possibly have unspecified other impact via a crafted .rle file, related to "Data from Faulting Address controls Branch Selection starting at KERNELBASE!StateObjectListFind+0x0000000000000005."...

CVE-2017-10783

XnView Classic for Windows Version 2.40 might allow attackers to cause a denial of service or possibly have unspecified other impact via a crafted .rle file, related to "Data from Faulting Address controls Branch Selection starting at ntdll77df0000!RtlpFreeHeap+0x0000000000000393."...