CVE-2017-9274

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
SUSEobs-service-source_validator>= unspecified, < 0.7

References

Timeline

Published
Mar 1, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-92756.1NetIQ Identity Reporting, in versions prior to 5.5 Service Pack 1, is susceptible to an XSS attack.CVE-2017-92766.1Novell Access Manager iManager before 4.3.3 did not validate parameters so that cross site scripting content could be reflected back into thCVE-2017-92777.5The LDAP backend in Novell eDirectory before 9.0 SP4 when switched to EBA (Enhanced Background Authentication) kept open connections withoutCVE-2017-92789.8The NetIQ Identity Manager Oracle EBS driver before 4.0.2.0 sent EBS logs containing the driver authentication password, potentially disclosCVE-2017-92797.2NetIQ Identity Manager before 4.5.6.1 allowed uploading files with double extensions or non-image content in the Themes handling of the UserCVE-2017-92807.5Some NetIQ Identity Manager Applications before Identity Manager 4.5.6.1 included the session token in GET URLs, potentially allowing exposuCVE-2017-92817.5An integer overflow (CWE-190) potentially causing an out-of-bounds read (CWE-125) vulnerability in Micro Focus VisiBroker 8.5 can lead to a CVE-2017-92829.8An integer overflow (CWE-190) led to an out-of-bounds write (CWE-787) on a heap-allocated area, leading to heap corruption in Micro Focus ViCVE-2017-92839.8An out-of-bounds read (CWE-125) vulnerability exists in Micro Focus VisiBroker 8.5. The feasibility of leveraging this vulnerability for furCVE-2017-92847.5IDM 4.6 Identity Applications prior to 4.6.2.1 may expose sensitive information.CVE-2017-92859.8NetIQ eDirectory before 9.0 SP4 did not enforce login restrictions when "ebaclient" was used, allowing unpermitted access to eDirectory servCVE-2017-92868.8The packaging of NextCloud in openSUSE used /srv/www/htdocs in an unsafe manner, which could have allowed scripts running as wwwrun user to
CVE-2017-9274: High severity, CVSS 7.8 | Vulnix