These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2017-5203 is a Critical buffer overflow in tcpdump’s BOOTP parser, specifically in print-bootp.c:bootp_print(), affecting tcpdump versions before 4.9.0. The NVD entry rates it 9.8 and maps it to CWE-119, with downstream advisories and package notes published for Debian, Red Hat, and Gentoo.
CVE-2017-5202 is a critical memory-corruption issue in tcpdump's ISO CLNS parser. The vulnerable path is clnp_print() in print-isoclns.c, and NVD rates the issue CVSS 3.0 9.8 with network reachability, no privileges, no user interaction, and high impact to confidentiality, integrity, and availability.
CVE-2017-3318 is a MySQL Server error-handling vulnerability that can expose sensitive data from affected server instances. The NVD record describes the flaw as difficult to exploit and notes that an attacker needs high privileges, local logon to the infrastructure where MySQL runs, and user interaction by another person. The primary impact is confidentiality: successful exploitation can lead to unauthori [truncated]
CVE-2017-3317 is a denial-of-service vulnerability in the MySQL Server logging component. According to NVD, exploitation requires a highly privileged attacker with local access and human interaction, and successful attacks can cause a hang or repeatable crash of MySQL Server.
CVE-2017-3313 is a MySQL Server vulnerability in the MyISAM subcomponent that can let a low-privileged attacker with logon access to the host compromise the MySQL Server process. Oracle’s description and the NVD record both emphasize confidentiality impact: successful attacks can expose critical data or all data accessible to MySQL Server. NVD rates the issue as local, high-complexity, low-privilege, no-u [truncated]
CVE-2017-3291 affects the MySQL Server packaging component in Oracle MySQL. NVD describes it as difficult to exploit and requiring a high-privileged attacker with logon access to the system where MySQL Server runs, plus human interaction from someone other than the attacker. If successful, the issue can lead to takeover of MySQL Server.
CVE-2017-3265 is a MySQL Server component vulnerability in the Packaging subcomponent that can let a highly privileged local attacker with logon access to the host compromise MySQL Server. NVD says successful exploitation may expose critical data or all MySQL-accessible data and can also cause a hang or repeatable crash, with human interaction required.
CVE-2017-3258 is a MySQL Server DDL weakness that can let a low-privileged network attacker trigger a hang or frequently repeatable crash, resulting in denial of service. Oracle’s advisory and the NVD record place affected Oracle MySQL releases at 5.5.53 and earlier, 5.6.34 and earlier, and 5.7.16 and earlier. NVD also maps downstream MariaDB and Linux distribution package entries for the same CVE. The pu [truncated]
CVE-2017-3244 is a medium-severity MySQL Server availability issue that can let a low-privileged network attacker cause a hang or repeatable crash of the database service. The vulnerability was publicly published on 2017-01-27 and later updated in NVD on 2026-05-13; the modification date should not be treated as the original issue date.
CVE-2017-3243 is a denial-of-service issue in the MySQL Server component of Oracle MySQL, specifically the Server: Charsets subcomponent. According to the NVD record, affected Oracle MySQL versions include 5.5.53 and earlier, and the impact is a hang or frequently repeatable crash of the server. Oracle’s advisory is listed as the patch/vendor reference, and NVD also maps related downstream package and ope [truncated]
CVE-2017-3238 is a network-reachable denial-of-service issue in the Oracle MySQL Server optimizer. Oracle and NVD describe it as exploitable by a low-privileged attacker over multiple protocols, with impact limited to availability: a hang or repeatable crash of MySQL Server. Oracle lists affected releases as MySQL 5.5.53 and earlier, 5.6.34 and earlier, and 5.7.16 and earlier.
CVE-2016-9636 is a critical heap-based buffer overflow in GStreamer's FLIC decoder. A crafted FLIC file can drive a write count beyond the initialized buffer in flx_decode_delta_fli, creating a remote code execution or crash risk. NVD rates the issue 9.8/CRITICAL with network attackability and no privileges or user interaction required.
CVE-2016-9635 is a critical memory-corruption flaw in GStreamer's FLIC decoder. A malformed "skip count" can run past the initialized buffer in flx_decode_delta_fli, which can crash the application and may allow arbitrary code execution. The vulnerable GStreamer line is listed as versions through 1.10.1, with a fix in 1.10.2 and downstream advisories for packaged Linux distributions.
CVE-2016-9634 is a critical memory-safety issue in GStreamer's FLIC decoder. A crafted FLIC file can trigger a heap-based buffer overflow in flx_decode_delta_fli, which can crash affected applications and may allow remote code execution in software that processes untrusted media.
CVE-2016-5824 affects libical 1.0 and can be triggered by a crafted .ics file, resulting in a denial of service through a use-after-free condition. NVD assigns a medium CVSS score (5.5) with high availability impact, and the official vector indicates user interaction is required. Organizations that parse calendar data or ship libical-based packages should treat this as a patching issue rather than a theor [truncated]
CVE-2016-9446 is an information-disclosure vulnerability in the GStreamer vmnc decoder. The issue is that the render canvas is not initialized before use, so a crafted vmnc file can cause previously stored memory contents to be exposed during processing or thumbnailing. The public description cites a simple 1-frame vmnc movie that does not draw to the allocated render canvas as a demonstration case. NVD r [truncated]
CVE-2016-9401 is a local bash issue tied to popd path handling. According to NVD, a local user may be able to bypass a restricted shell and trigger a use-after-free with a crafted address. The published impact is availability-focused, but the restricted-shell bypass makes this important anywhere bash is part of a controlled local access model.
CVE-2016-7545 is a local SELinux policycoreutils issue where a crafted TIOCSTI ioctl call can let an attacker run arbitrary commands outside the intended sandbox boundary. NVD assigns a HIGH severity score, and the weakness is categorized as improper access control (CWE-284). The CVE was published on 2017-01-19, with earlier discussion and patch references appearing in September 2016 and vendor advisories [truncated]
CVE-2016-9811 is a denial-of-service vulnerability in GStreamer's gst-plugins-base component, specifically the windows_icon_typefind function in versions before 1.10.2. The issue is an out-of-bounds read triggered by a crafted ICO file. NVD records this CVE as published on 2017-01-13 and later modified on 2026-05-13.
CVE-2012-4550 describes an access-control flaw in Red Hat JBoss Enterprise Application Platform. When role-based authorization is used for Enterprise Java Beans (EJB) access, the platform may fail to invoke the required authorization modules, which prevents Java Authorization Contract for Containers (JACC) permissions from being enforced. The result is that a remote attacker may gain unauthorized access t [truncated]
CVE-2012-4549 is an access-control flaw in Red Hat JBoss Enterprise Application Platform. When an EJB method invocation has no roles defined, the AuthorizationInterceptor processInvocation path can incorrectly authorize the request instead of denying it. In practice, that can expose sensitive EJB functionality to unauthenticated or otherwise unauthorized network attackers.