CVE-2017-14849
High · 7.5CVSS
7.5
EPSS
54.4%
Published
Sep 28, 2017
CISA due date
—
The record
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was incompatible with the pathname validation used by unspecified community modules.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Server 11 SP4-LTSS | MozillaFirefox | 0 | 68.2.0-78.51.4 |
| SUSE:Linux Enterprise Server 11 SP4-LTSS | MozillaFirefox-branding-SLED | 0 | 68-21.9.8 |
| SUSE:Linux Enterprise Server 11 SP4-LTSS | firefox-atk | 0 | 2.26.1-2.8.4 |
| SUSE:Linux Enterprise Server 11 SP4-LTSS | firefox-cairo | 0 | 1.15.10-2.13.4 |
| SUSE:Linux Enterprise Server 11 SP4-LTSS | firefox-gdk-pixbuf | 0 | 2.36.11-2.8.4 |
| SUSE:Linux Enterprise Server 11 SP4-LTSS | firefox-glib2 | 0 | 2.54.3-2.14.7 |
| SUSE:Linux Enterprise Server 11 SP4-LTSS | firefox-gtk3 | 0 | 3.10.9-2.15.3 |
| SUSE:Linux Enterprise Server 11 SP4-LTSS | firefox-harfbuzz | 0 | 1.7.5-2.7.4 |
| SUSE:Linux Enterprise Server 11 SP4-LTSS | firefox-libffi | 0 | 3.2.1.git259-2.3.3 |
| SUSE:Linux Enterprise Server 11 SP4-LTSS | firefox-libffi-gcc5 | 0 | 5.3.1+r233831-14.1 |
| SUSE:Linux Enterprise Server 11 SP4-LTSS | firefox-pango | 0 | 1.40.14-2.7.4 |
| SUSE:Linux Enterprise Server 11 SP4-LTSS | mozilla-nspr | 0 | 4.21-29.6.1 |
| SUSE:Linux Enterprise Server 11 SP4-LTSS | mozilla-nss | 0 | 3.45-38.9.3 |
Related vulnerabilities
- CVE-2022-28289 Mozilla developers and community members Nika Layzell, Andrew McCreight, Gabriele Svelto… Also affects MozillaFirefox
- CVE-2022-28285 When generating the assembly code for MLoadTypedArrayElementHole, an incorrect AliasSet… Also affects MozillaFirefox
- CVE-2022-28286 Due to a layout change, iframe contents could have been rendered outside of its border. Also affects MozillaFirefox
- CVE-2022-28282 By using a link with rel="localization" a use-after-free could have been triggered by… Also affects MozillaFirefox
- CVE-2022-28281 If a compromised content process sent an unexpected number of WebAuthN Extensions in a… Also affects MozillaFirefox
- CVE-2022-26485 Removing an XSLT parameter during processing could have lead to an exploitable… Also affects MozillaFirefox
- CVE-2022-26486 An unexpected message in the WebGPU IPC framework could lead to a use-after-free and… Also affects MozillaFirefox
- CVE-2022-26387 When installing an add-on, Firefox verified the signature before prompting the user; but… Also affects MozillaFirefox