CVE-2017-13083

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Akeo Consulting Rufus prior to version 2.17.1187 does not adequately validate the integrity of updates downloaded over HTTP, allowing an attacker to easily convince a user to execute arbitrary code

Metrics

CVSS 3.0 8.1/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-295 CWE-345 CWE-347 CWE-494

Affected software

Vendor	Product	Versions
Akeo Consulting	Rufus	prior to 2.17.1187

References

http://www.kb.cert.org/vuls/id/403768Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/100516Third Party Advisory, VDB Entry
https://github.com/pbatard/rufus/commit/c3c39f7f8a11f612c4ebf7affce25ec6928eb1cbThird Party Advisory
https://github.com/pbatard/rufus/issues/1009Third Party Advisory
http://www.kb.cert.org/vuls/id/403768Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/100516Third Party Advisory, VDB Entry
https://github.com/pbatard/rufus/commit/c3c39f7f8a11f612c4ebf7affce25ec6928eb1cbThird Party Advisory
https://github.com/pbatard/rufus/issues/1009Third Party Advisory

Timeline

Published: Oct 18, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-130846.8Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Station-To-Station-Link (STSL) Transient Key (STK) during the PeerKey han CVE-2017-130866.8Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Tunneled Direct-Link Setup (TDLS) Peer Key (TPK) during the TDLS handshak CVE-2017-130875.3Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Group Temporal Key (GTK) when processing a Wireless CVE-2017-130885.3Wi-Fi Protected Access (WPA and WPA2) that support 802.11v allows reinstallation of the Integrity Group Temporal Key (IGTK) when processing CVE-2017-130898.8The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked CVE-2017-13097.8IBM InfoSphere Master Data Management Server 11.0 - 11.6 stores user credentials in plain in clear text which can be read by a local user. I CVE-2017-130908.8The retr.c:fd_read_body() function is called when processing OK responses. When the response is sent chunked in wget before 1.19.2, the chun CVE-2017-130917.8The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of a CVE-2017-130927.8The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of a CVE-2017-130937.8The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of a CVE-2017-130947.8The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of a CVE-2017-130957.8The P1735 IEEE standard describes flawed methods for encrypting electronic-design intellectual property (IP), as well as the management of a