The kernel in Microsoft Windows XP SP2, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly load structured exception handling tables, which allows context-dependent attackers to bypass the SafeSEH security feature by leveraging a Visual C++ .NET 2003 application, aka "Windows Kernel SafeSEH Bypass Vulnerability." openSUSE-SU-2012:0917 51296 1026493 TA12-010A MS12-001 oval:org.mitre.oval:def:14758 The Remote Desktop Protocol (RDP) implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly process packets in memory, which allows remote attackers to execute arbitrary code by sending crafted RDP packets triggering access to an object that (1) was not properly initialized or (2) is deleted, aka "Remote Desktop Protocol Vulnerability." Per: http://technet.microsoft.com/en-us/security/bulletin/ms12-020 "By default, the Remote Desktop Protocol is not enabled on any Windows operating system. Systems that do not have RDP enabled are not at risk. Note that on Windows XP and Windows Server 2003, Remote Assistance can enable RDP." http://blogs.quickheal.com/remote-desktop-protocol-vulnerability-cve-2012-0002-not-dead-yet/ 1026790 TA12-073A MS12-020 oval:org.mitre.oval:def:14623 Unspecified vulnerability in winmm.dll in Windows Multimedia Library in Windows Media Player (WMP) in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows remote attackers to execute arbitrary code via a crafted MIDI file, aka "MIDI Remote Code Execution Vulnerability." 51292 1026492 TA12-010A MS12-004 oval:org.mitre.oval:def:14337 Unspecified vulnerability in DirectShow in DirectX in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted media file, related to Quartz.dll, Qdvd.dll, closed captioning, and the Line21 DirectShow filter, aka "DirectShow Remote Code Execution Vulnerability." 51295 1026492 TA12-010A MS12-004 oval:org.mitre.oval:def:14832 The Client/Server Run-time Subsystem (aka CSRSS) in the Win32 subsystem in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP2, and Server 2008 SP2, when a Chinese, Japanese, or Korean system locale is used, can access uninitialized memory during the processing of Unicode characters, which allows local users to gain privileges via a crafted application, aka "CSRSS Elevation of Privilege Vulnerability." 51270 1026495 TA12-010A MS12-003 oval:org.mitre.oval:def:14879 The DNS server in Microsoft Windows Server 2003 SP2 and Server 2008 SP2, R2, and R2 SP1 does not properly handle objects in memory during record lookup, which allows remote attackers to cause a denial of service (daemon restart) via a crafted query, aka "DNS Denial of Service Vulnerability." 80005 48394 52374 1026789 TA12-073A MS12-017 oval:org.mitre.oval:def:15098 The Microsoft Anti-Cross Site Scripting (AntiXSS) Library 3.x and 4.0 does not properly evaluate characters after the detection of a Cascading Style Sheets (CSS) escaped character, which allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML input, aka "AntiXSS Library Bypass Vulnerability." 51291 1026499 TA12-010A MS12-007 oval:org.mitre.oval:def:14314 Untrusted search path vulnerability in Microsoft Visual Studio 2008 SP1, 2010, and 2010 SP1 allows local users to gain privileges via a Trojan horse add-in in an unspecified directory, aka "Visual Studio Add-In Vulnerability." Per: http://cwe.mitre.org/data/definitions/426.html 'CWE-426: Untrusted Search Path' Per: http://technet.microsoft.com/en-us/security/bulletin/ms12-021 'An attacker could then place a specially crafted add-in in the path used by Visual Studio. When Visual Studio is started by an administrator, the specially crafted add-in would be loaded with the same privileges as the administrator.' 'The vulnerability could not be exploited remotely or by anonymous users.' 48396 52329 1026792 TA12-073A MS12-021 ms-visual-studio-priv-esc(73537) oval:org.mitre.oval:def:15081 Untrusted search path vulnerability in the Windows Object Packager configuration in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a Trojan horse executable file in the current working directory, as demonstrated by a directory that contains a file with an embedded packaged object, aka "Object Packager Insecure Executable Launching Vulnerability." Per: http://cwe.mitre.org/data/definitions/426.html 'CWE-426: Untrusted Search Path' Per: http://technet.microsoft.com/en-us/security/bulletin/ms12-002 'The vulnerability could allow remote code execution if a user opens a legitimate file with an embedded packaged object that is located in the same network directory as a specially crafted executable file.' 51297 1026494 TA12-010A MS12-002 oval:org.mitre.oval:def:14393 Microsoft Internet Explorer 6 through 9 does not properly perform copy-and-paste operations, which allows user-assisted remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Copy and Paste Information Disclosure Vulnerability." MS12-010 oval:org.mitre.oval:def:14835 Microsoft Internet Explorer 7 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "HTML Layout Remote Code Execution Vulnerability." TA12-045A MS12-010 oval:org.mitre.oval:def:14310 Microsoft Internet Explorer 9 does not properly handle the creation and initialization of string objects, which allows remote attackers to read data from arbitrary process-memory locations via a crafted web site, aka "Null Byte Information Disclosure Vulnerability." TA12-045A MS12-010 oval:org.mitre.oval:def:14870 Incomplete blacklist vulnerability in the Windows Packager configuration in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted ClickOnce application in a Microsoft Office document, related to .application files, aka "Assembly Execution Vulnerability." 51284 1026497 TA12-010A MS12-005 oval:org.mitre.oval:def:14197 Microsoft .NET Framework 2.0 SP2, 3.5.1, and 4, and Silverlight 4 before 4.1.10111, does not properly restrict access to memory associated with unmanaged objects, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, (3) a crafted .NET Framework application, or (4) a crafted Silverlight application, aka ".NET Framework Unmanaged Objects Vulnerability." TA12-045A MS12-016 oval:org.mitre.oval:def:13972 Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not properly calculate the length of an unspecified buffer, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka ".NET Framework Heap Corruption Vulnerability." TA12-045A MS12-016 oval:org.mitre.oval:def:14513 Untrusted search path vulnerability in Microsoft Expression Design; Expression Design SP1; and Expression Design 2, 3, and 4 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .xpr or .DESIGN file, aka "Expression Design Insecure Library Loading Vulnerability." Per: http://cwe.mitre.org/data/definitions/426.html 'CWE-426: Untrusted Search Path' Per: http://technet.microsoft.com/en-us/security/bulletin/ms12-022 'This is a remote code execution vulnerability.' TA12-073A MS12-022 oval:org.mitre.oval:def:14973 Cross-site scripting (XSS) vulnerability in inplview.aspx in Microsoft SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via JavaScript sequences in a URL, aka "XSS in inplview.aspx Vulnerability." TA12-045A MS12-011 oval:org.mitre.oval:def:14637 Microsoft Visio Viewer 2010 Gold and SP1 does not properly validate attributes in Visio files, which allows remote attackers to execute arbitrary code via a crafted file, aka "VSD File Format Memory Corruption Vulnerability." 53328 1027042 TA12-129A MS12-031 visio-memory-code-exec(75115) oval:org.mitre.oval:def:15606 Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execute arbitrary code via crafted attributes in a Visio file, aka "VSD File Format Memory Corruption Vulnerability," a different vulnerability than CVE-2012-0020, CVE-2012-0136, CVE-2012-0137, and CVE-2012-0138. TA12-045A MS12-015 oval:org.mitre.oval:def:14347 Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execute arbitrary code via crafted attributes in a Visio file, aka "VSD File Format Memory Corruption Vulnerability," a different vulnerability than CVE-2012-0019, CVE-2012-0136, CVE-2012-0137, and CVE-2012-0138. TA12-045A MS12-015 oval:org.mitre.oval:def:14965 The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %{}C format string, which allows remote attackers to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value. HPSBMU02786 http://httpd.apache.org/security/vulnerabilities_22.html APPLE-SA-2012-09-19-2 SSRT100772 HPSBUX02761 RHSA-2012:0542 RHSA-2012:0543 http://support.apple.com/kb/HT5501 http://svn.apache.org/viewvc?view=revision&revision=1227292 MDVSA-2012:012 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html https://bugzilla.redhat.com/show_bug.cgi?id=785065 https://issues.apache.org/bugzilla/show_bug.cgi?id=52256 [httpd-cvs] 20190815 svn commit: r1048743 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html [httpd-cvs] 20190815 svn commit: r1048742 [3/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a different vulnerability than CVE-2011-4858. 20120117 [SECURITY] CVE-2012-0022 Apache Tomcat Denial of Service SSRT100728 SSRT100771 HPSBUX02860 RHSA-2012:0074 RHSA-2012:0075 RHSA-2012:0076 RHSA-2012:0077 RHSA-2012:0078 RHSA-2012:0325 RHSA-2012:0345 RHSA-2012:1331 48549 http://tomcat.apache.org/security-5.html http://tomcat.apache.org/security-6.html http://tomcat.apache.org/security-7.html DSA-2401 MDVSA-2012:085 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html 51447 apache-tomcat-parameter-dos(72425) [tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/ [tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/ oval:org.mitre.oval:def:16925 oval:org.mitre.oval:def:18934 Double free vulnerability in the get_chunk_header function in modules/demux/ty.c in VideoLAN VLC media player 0.9.0 through 1.1.12 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TiVo (TY) file. http://git.videolan.org/?p=vlc.git;a=commit;h=7d282fac1cc455b5a5eca2bb56375efcbf879b06 1026449 [oss-security] 20121029 VideoLAN TiVo Demuxer Duplicate CVEs (CVE-2011-5231 and CVE-2012-0023) [oss-security] 20121030 RE: VideoLAN TiVo Demuxer Duplicate CVEs (CVE-2011-5231 and CVE-2012-0023) 51231 http://www.videolan.org/security/sa1108.html vlcmediaplayer-getchunkheader-code-exec(71916) oval:org.mitre.oval:def:15893 MaraDNS before 1.3.07.12 and 1.4.x before 1.4.08 computes hash values for DNS data without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted queries with the Recursion Desired (RD) bit set. [oss-security] 20120103 Re: CVE request: maradns hash table collision cpu dos [oss-security] 20120103 CVE request: maradns hash table collision cpu dos http://samiam.org/blog/20111229.html https://bugzilla.redhat.com/show_bug.cgi?id=771428 Double free vulnerability in the Free_All_Memory function in jpeg/dectile.c in libfpx before 1.3.1-1, as used in the FlashPix PlugIn 4.2.2.0 for IrfanView, allows remote attackers to cause a denial of service (crash) via a crafted FPX image. 18256 http://www.imagemagick.org/download/delegates/libfpx-1.3.1-1.zip [oss-security] 20120103 Re: CVE request: libfpx "Free_All_Memory()" Double-Free Vulnerability [oss-security] 20121102 Re: libfpx Duplicate CVEs (CVE-2011-5232 and CVE-2012-0025) http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=31&Itemid=31 libfpx-freeallmemory-code-exec(71892) GLSA-201605-03 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-0287. Reason: This candidate is a duplicate of CVE-2012-0287. Notes: All CVE users should reference CVE-2012-0287 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service (daemon crash) via crafted data from a TLS client. HPSBMU02786 openSUSE-SU-2012:0083 MDVSA-2012:007 http://www.openssl.org/news/secadv_20120104.txt http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564 The robust futex implementation in the Linux kernel before 2.6.28 does not properly handle processes that make exec system calls, which allows local users to cause a denial of service or possibly gain privileges by writing to a memory location in a child process. http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.28 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8141c7f3e7aee618312fa1c15109e1219de784a7 [oss-security] 20120508 Re: CVE Request -- kernel: futex: clear robust_list on execve https://bugzilla.redhat.com/show_bug.cgi?id=771764 https://github.com/torvalds/linux/commit/8141c7f3e7aee618312fa1c15109e1219de784a7 Heap-based buffer overflow in the process_tx_desc function in the e1000 emulation (hw/e1000.c) in qemu-kvm 0.12, and possibly other versions, allows guest OS users to cause a denial of service (QEMU crash) and possibly execute arbitrary code via crafted legacy mode packets. http://git.qemu.org/?p=qemu.git;a=log;h=refs/heads/stable-1.0 FEDORA-2012-8604 SUSE-SU-2012:1320 openSUSE-SU-2012:0207 RHSA-2012:0370 RHSA-2012:0050 51642 USN-1339-1 https://bugzilla.redhat.com/show_bug.cgi?id=772075 qemu-processtxdesc-bo(72656) Nova 2011.3 and Essex, when using the OpenStack API, allows remote authenticated users to bypass access restrictions for tenants of other users via an OSAPI request with a modified project_id URI parameter. 51370 USN-1326-1 nova-security-bypass(72296) https://github.com/openstack/nova/commit/3d4ffb64f1e18117240c26809788528979e3bd15#diff-0 [openstack] 20120111 [OSSA 2012-001] Tenant bypass by authenticated users using OpenStack API (CVE-2012-0030) scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory segment, leading to an invalid call to the free function. HPSBMU02786 APPLE-SA-2012-09-19-2 openSUSE-SU-2012:0314 SUSE-SU-2012:0323 SSRT100772 HPSBUX02761 SSRT100966 RHSA-2012:0128 RHSA-2012:0542 RHSA-2012:0543 http://support.apple.com/kb/HT5501 http://svn.apache.org/viewvc?view=revision&revision=1230065 DSA-2405 http://www.halfdog.net/Security/2011/ApacheScoreboardInvalidFreeOnShutdown/ MDVSA-2012:012 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 51407 https://bugzilla.redhat.com/show_bug.cgi?id=773744 [httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html [httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html Red Hat JBoss Operations Network (JON) before 3.0.1 uses 0777 permissions for the root directory when installing a remote client, which allows local users to read or modify subdirectories and files within the root directory, as demonstrated by obtaining JON credentials. RHSA-2012:0406 https://bugzilla.redhat.com/show_bug.cgi?id=772514 The CBounceDCCMod::OnPrivCTCP function in bouncedcc.cpp in the bouncedcc module in ZNC 0.200 and 0.202 allows remote attackers to cause a denial of service (crash) via a crafted DCC RESUME request. openSUSE-SU-2015:1886 [oss-security] 20120109 Re: CVE request: znc 51328 https://github.com/znc/znc/commit/11508aa72efab4fad0dbd8292b9614d9371b20a9#modules/bouncedcc.cpp The NonManagedConnectionFactory in JBoss Enterprise Application Platform (EAP) 5.1.2 and 5.2.0, Web Platform (EWP) 5.1.2 and 5.2.0, and BRMS Platform before 5.3.1 logs the username and password in cleartext when an exception is thrown, which allows local users to obtain sensitive information by reading the log file. Per http://rhn.redhat.com/errata/RHSA-2013-0192.html "This JBoss Enterprise Application Platform 5.2.0 release serves as a replacement for JBoss Enterprise Application Platform 5.1.2, and includes bug fixes and enhancements." Per http://rhn.redhat.com/errata/RHSA-2013-0196.html "This JBoss Enterprise Web Platform 5.2.0 release serves as a replacement for JBoss Enterprise Web Platform 5.1.2, and includes bug fixes and enhancements." RHSA-2012:0108 RHSA-2012:1072 RHSA-2013:0191 RHSA-2013:0192 RHSA-2013:0193 RHSA-2013:0195 RHSA-2013:0196 RHSA-2013:0197 RHSA-2013:0221 RHSA-2013:0533 51392 https://bugzilla.redhat.com/show_bug.cgi?id=772835 https://issues.jboss.org/browse/JBCACHE-1612 Untrusted search path vulnerability in EDE in CEDET before 1.0.1, as used in GNU Emacs before 23.4 and other products, allows local users to gain privileges via a crafted Lisp expression in a Project.ede file in the directory, or a parent directory, of an opened file. Per: http://cwe.mitre.org/data/definitions/426.html 'CWE-426: Untrusted Search Path' FEDORA-2012-0462 FEDORA-2012-0494 [emacs-devel] 20120109 Security flaw in EDE; new release plans [oss-security] 20120109 CVE Request: CEDET/Emacs global-ede-mode file loading vulnerability [oss-security] 20120109 Re: Re: CVE Request: CEDET/Emacs global-ede-mode file loading vulnerability [cedet-devel] 20120109 Security flaw in EDE [cedet-devel] 20120111 CEDET 1.0.1 available online MDVSA-2013:076 USN-1586-1 GLSA-201812-05 curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol. http://curl.haxx.se/curl-url-sanitize.patch http://curl.haxx.se/docs/adv_20120124.html HPSBMU02786 APPLE-SA-2012-05-09-1 48256 GLSA-201203-02 http://support.apple.com/kb/HT5281 DSA-2398 MDVSA-2012:058 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html 51665 1032924 https://bugzilla.redhat.com/show_bug.cgi?id=773457 https://github.com/bagder/curl/commit/75ca568fa1c19de4c5358fed246686de8467c238 https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03760en_us Redland Raptor (aka libraptor) before 2.0.7, as used by OpenOffice 3.3 and 3.4 Beta, LibreOffice before 3.4.6 and 3.5.x before 3.5.1, and other products, allows user-assisted remote attackers to read arbitrary files via a crafted XML external entity (XXE) declaration and reference in an RDF document. http://blog.documentfoundation.org/2012/03/22/tdf-announces-libreoffice-3-4-6/ http://librdf.org/raptor/RELEASE.html#rel2_0_7 FEDORA-2012-4629 FEDORA-2012-4663 RHSA-2012:0410 RHSA-2012:0411 GLSA-201209-05 http://vsecurity.com/resources/advisory/20120324-1/ DSA-2438 GLSA-201408-19 http://www.libreoffice.org/advisories/CVE-2012-0037/ MDVSA-2012:061 MDVSA-2012:062 MDVSA-2012:063 http://www.openoffice.org/security/cves/CVE-2012-0037.html [oss-security] 20120427 Fwd: CVE-2012-0037: libraptor - XXE in RDF/XML File Interpretation (Multiple office products affected) 52681 1026837 openoffice-xml-info-disclosure(74235) https://github.com/dajobe/raptor/commit/a676f235309a59d4aa78eeffd2574ae5d341fcb0 Integer overflow in the xfs_acl_from_disk function in fs/xfs/xfs_acl.c in the Linux kernel before 3.1.9 allows local users to cause a denial of service (panic) via a filesystem with a malformed ACL, leading to a heap-based buffer overflow. http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=093019cf1b18dd31b2c3b77acce4e000e2cbc9ce http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=fa8b18edd752a8b4e9d1ee2cd615b82c93cf8bba http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.1.9 [oss-security] 20120110 Re: CVE request: kernel: xfs heap overflow https://bugzilla.redhat.com/show_bug.cgi?id=773280 https://github.com/torvalds/linux/commit/093019cf1b18dd31b2c3b77acce4e000e2cbc9ce https://github.com/torvalds/linux/commit/fa8b18edd752a8b4e9d1ee2cd615b82c93cf8bba ** DISPUTED ** GLib 2.31.8 and earlier, when the g_str_hash function is used, computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. NOTE: this issue may be disputed by the vendor; the existence of the g_str_hash function is not a vulnerability in the library, because callers of g_hash_table_new and g_hash_table_new_full can specify an arbitrary hash function that is appropriate for the application. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=655044 [gtk-devel-list] 20030529 Algorimic Complexity Attack on GLIB 2.2.1 [oss-security] 20120110 glib2 hash dos oCert-2011-003 https://bugzilla.redhat.com/show_bug.cgi?id=772720 Cross-site scripting (XSS) vulnerability in modules/core/www/no_cookie.php in SimpleSAMLphp 1.8.1 and possibly other versions before 1.8.2 allows remote attackers to inject arbitrary web script or HTML via the retryURL parameter. http://code.google.com/p/simplesamlphp/issues/detail?id=468 DSA-2387 [oss-security] 20120120 Re: CVE request: simpleSAMLphp 1.8.2 cross site scripting 51372 simplesamlphp-nocookie-logout-xss(72313) The dissect_packet function in epan/packet.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in a capture file, as demonstrated by an airopeek file. http://anonsvn.wireshark.org/viewvc?view=revision&revision=40164 RHSA-2013:0125 GLSA-201308-05 [oss-security] 20120111 Re: CVE request: Wireshark multiple vulnerabilities [oss-security] 20120119 Re: CVE request: Wireshark multiple vulnerabilities http://www.wireshark.org/security/wnpa-sec-2012-01.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6663 oval:org.mitre.oval:def:15297 Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 does not properly perform certain string conversions, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted packet, related to epan/to_str.c. Per: http://cwe.mitre.org/data/definitions/476.html 'CWE-476: NULL Pointer Dereference' http://anonsvn.wireshark.org/viewvc?view=revision&revision=40194 RHSA-2013:0125 GLSA-201308-05 [oss-security] 20120111 Re: CVE request: Wireshark multiple vulnerabilities 1026507 http://www.wireshark.org/security/wnpa-sec-2012-02.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6634 oval:org.mitre.oval:def:15368 Buffer overflow in the reassemble_message function in epan/dissectors/packet-rlc.c in the RLC dissector in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a series of fragmented RLC packets. http://anonsvn.wireshark.org/viewvc?view=revision&revision=40266 GLSA-201308-05 [oss-security] 20120111 Re: CVE request: Wireshark multiple vulnerabilities 1026508 http://www.wireshark.org/security/wnpa-sec-2012-03.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6391 oval:org.mitre.oval:def:15324 Integer overflow in the drm_mode_dirtyfb_ioctl function in drivers/gpu/drm/drm_crtc.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 3.1.5 allows local users to gain privileges or cause a denial of service (memory corruption) via a crafted ioctl call. http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a5cd335165e31db9dbab636fd29895d41da55dd2 RHSA-2012:0743 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.1.5 [oss-security] 20120111 Re: CVE request - kernel: drm: integer overflow in drm_mode_dirtyfb_ioctl() 51371 USN-1555-1 USN-1556-1 https://bugzilla.redhat.com/show_bug.cgi?id=772894 https://github.com/torvalds/linux/commit/a5cd335165e31db9dbab636fd29895d41da55dd2 The em_syscall function in arch/x86/kvm/emulate.c in the KVM implementation in the Linux kernel before 3.2.14 does not properly handle the 0f05 (aka syscall) opcode, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application, as demonstrated by an NASM file. http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c2226fc9e87ba3da060e47333657cd6616652b84 SUSE-SU-2012:0616 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.14 [oss-security] 20120111 Re: CVE request -- kernel: kvm: syscall instruction induced guest panic https://bugzilla.redhat.com/show_bug.cgi?id=773370 https://github.com/torvalds/linux/commit/c2226fc9e87ba3da060e47333657cd6616652b84 Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.20 allows remote attackers to inject arbitrary web script or HTML via the wicket:pageMapName parameter. 20120322 [CVE-2012-0047] Apache Wicket XSS vulnerability via pageMapName request parameter http://wicket.apache.org/2012/03/22/wicket-cve-2012-0047.html 1026839 apache-wicket-unspec-xss(74273) OpenTTD 0.3.5 through 1.1.4 allows remote attackers to cause a denial of service (game pause) by connecting to the server and not finishing the (1) authorization phase or (2) map download, aka a "slow read" attack. http://bugs.openttd.org/task/4955 http://security.openttd.org/en/CVE-2012-0049 http://vcs.openttd.org/svn/changeset/23764 DSA-2524 [oss-security] 20120107 CVE request for OpenTTD [oss-security] 20120113 Re: CVE request for OpenTTD http://www.tt-forums.net/viewtopic.php?f=33&t=58073&hilit=pause#p989303 OpenSSL 0.9.8s and 1.0.0f does not properly support DTLS applications, which allows remote attackers to cause a denial of service (crash) via unspecified vectors related to an out-of-bounds read. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4108. http://aix.software.ibm.com/aix/efixes/security/openssl_advisory3.asc HPSBUX02737 APPLE-SA-2013-06-04-1 SSRT100852 HPSBOV02793 http://support.apple.com/kb/HT5784 DSA-2392 MDVSA-2012:011 http://www.openssl.org/news/secadv_20120118.txt 51563 1026548 http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564 Red Hat JBoss Operations Network (JON) before 2.4.2 and 3.0.x before 3.0.1 does not check the JON agent key, which allows remote attackers to spoof the identity of arbitrary agents via the registered agent name. RHSA-2012:0089 RHSA-2012:0406 https://bugzilla.redhat.com/show_bug.cgi?id=781964 protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script. HPSBMU02786 http://httpd.apache.org/security/vulnerabilities_22.html http://kb.juniper.net/JSA10585 APPLE-SA-2012-09-19-2 openSUSE-SU-2012:0314 SUSE-SU-2012:0323 SSRT100772 HPSBUX02761 SSRT100852 SSRT101112 RHSA-2012:0128 RHSA-2012:0542 RHSA-2012:0543 http://support.apple.com/kb/HT5501 http://svn.apache.org/viewvc?view=revision&revision=1235454 DSA-2405 MDVSA-2012:012 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 51706 https://bugzilla.redhat.com/show_bug.cgi?id=785069 [httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html [httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html libs/updater.py in GoLismero 0.6.3, and other versions before Git revision 2b3bb43d6867, as used in backtrack and possibly other products, allows local users to overwrite arbitrary files via a symlink attack on GoLismero-controlled files, as demonstrated using Admin/changes.dat. http://code.google.com/p/golismero/source/detail?r=2b3bb43d68676efd687361f7de29380189031ab8 [oss-security] 20120117 Re: CVE-request: golismero symlink vulnerability [oss-security] 20120117 CVE-request: golismero symlink vulnerability The mem_write function in the Linux kernel before 3.2.2, when ASLR is disabled, does not properly check permissions when writing to /proc/<pid>/mem, which allows local users to gain privileges by modifying process memory, as demonstrated by Mempodipper. http://blog.zx2c4.com/749 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=e268337dfe26dfc7efd422a804dbb27977a3cccc USN-1336-1 VU#470151 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.2 [oss-security] 20120118 CVE request: kernel: proc: clean up and fix /proc/<pid>/mem handling [oss-security] 20120117 Re: CVE request: kernel: proc: clean up and fix /proc/<pid>/mem handling [oss-security] 20120119 Re: CVE request: kernel: proc: clean up and fix /proc/<pid>/mem handling [oss-security] 20120122 Re: CVE request: kernel: proc: clean up and fix /proc/<pid>/mem handling RHSA-2012:0052 RHSA-2012:0061 51625 https://bugzilla.redhat.com/show_bug.cgi?id=782642 PHP before 5.3.9 has improper libxslt security settings, which allows remote attackers to create arbitrary files via a crafted XSLT stylesheet that uses the libxslt output extension. HPSBMU02786 SUSE-SU-2012:0411 openSUSE-SU-2012:0426 SUSE-SU-2012:0472 [oss-security] 20120113 Re: CVE affected for PHP 5.3.9 ? [oss-security] 20120113 CVE affected for PHP 5.3.9 ? [oss-security] 20120113 Re: CVE affected for PHP 5.3.9 ? [oss-security] 20120113 Re: CVE affected for PHP 5.3.9 ? [oss-security] 20120113 Re: CVE affected for PHP 5.3.9 ? [oss-security] 20120113 Re: CVE affected for PHP 5.3.9 ? [oss-security] 20120114 Re: CVE affected for PHP 5.3.9 ? [oss-security] 20120114 Re: CVE affected for PHP 5.3.9 ? [oss-security] 20120115 Re: CVE affected for PHP 5.3.9 ? [oss-security] 20120115 Re: CVE affected for PHP 5.3.9 ? [oss-security] 20120114 Re: CVE affected for PHP 5.3.9 ? [oss-security] 20120117 Re: CVE affected for PHP 5.3.9 ? http://php.net/ChangeLog-5.php#5.3.9 DSA-2399 https://bugs.php.net/bug.php?id=54446 php-libxslt-security-bypass(72908) The kiocb_batch_free function in fs/aio.c in the Linux kernel before 3.2.2 allows local users to cause a denial of service (OOPS) via vectors that trigger incorrect iocb management. HPSBGN02970 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.2 [oss-security] 20120117 Re: CVE request: kernel: Unused iocbs in a batch should not be accounted as active 1027085 https://bugzilla.redhat.com/show_bug.cgi?id=782696 https://github.com/torvalds/linux/commit/802f43594d6e4d2ac61086d239153c17873a0428 Spacewalk-backend in Red Hat Network (RHN) Satellite and Proxy 5.4 includes cleartext user passwords in an error message when a system registration XML-RPC call fails, which allows remote administrators to obtain the password by reading (1) the server log and (2) an email. RHSA-2012:0101 RHSA-2012:0102 RPM before 4.9.1.3 does not properly validate region tags, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an invalid region tag in a package header to the (1) headerLoad, (2) rpmReadSignature, or (3) headerVerify function. FEDORA-2012-5298 FEDORA-2012-5420 FEDORA-2012-5421 RHSA-2012:0451 RHSA-2012:0531 http://rpm.org/gitweb?p=rpm.git;a=commitdiff;h=e4eab2bc6d07cfd33f740071de7ddbb2fe2f4190 http://rpm.org/gitweb?p=rpm.git;a=commitdiff;h=f23998251992b8ae25faf5113c42fee2c49c7f29 http://rpm.org/wiki/Releases/4.9.1.3 MDVSA-2012:056 http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html 52865 1026882 USN-1695-1 https://bugzilla.redhat.com/show_bug.cgi?id=744858 rpm-loadsigverify-code-execution(74582) openSUSE-SU-2012:0588 openSUSE-SU-2012:0589 The headerLoad function in lib/header.c in RPM before 4.9.1.3 does not properly validate region tags, which allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large region size in a package header. FEDORA-2012-5298 FEDORA-2012-5420 FEDORA-2012-5421 RHSA-2012:0451 RHSA-2012:0531 http://rpm.org/gitweb?p=rpm.git;a=commitdiff;h=472e569562d4c90d7a298080e0052856aa7fa86b http://rpm.org/gitweb?p=rpm.git;a=commitdiff;h=858a328cd0f7d4bcd8500c78faaf00e4f8033df6 http://rpm.org/wiki/Releases/4.9.1.3 MDVSA-2012:056 http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html 52865 1026882 USN-1695-1 https://bugzilla.redhat.com/show_bug.cgi?id=798585 rpm-headerload-code-execution(74583) openSUSE-SU-2012:0588 openSUSE-SU-2012:0589 Red Hat JBoss Operations Network (JON) before 2.4.2 and 3.0.x before 3.0.1 allows remote attackers to hijack agent sessions via an agent registration request without a security token. RHSA-2012:0089 RHSA-2012:0406 https://bugzilla.redhat.com/show_bug.cgi?id=783008 xkeyboard-config before 2.5 in X.Org before 7.6 enables certain XKB debugging functions by default, which allows physically proximate attackers to bypass an X screen lock via keyboard combinations that break the input grab. http://gu1.aeroxteam.fr/2012/01/19/bypass-screensaver-locker-program-xorg-111-and-up/ [xorg-announce] 20120119 xkeyboard-config 2.5 [xorg-devel] 20120119 [PATCH SECURITY] XKB: Workaround for CVE-2012-0064: Stop calling UngrabAllDevices(). 1026549 http://who-t.blogspot.com/2012/01/xkb-breaking-grabs-cve-2012-0064.html [oss-security] 20120118 Re: Screen locking programs on Xorg 1.11 http://www.x.org/wiki/Development/Security/ https://bugzilla.redhat.com/show_bug.cgi?id=783039 Heap-based buffer overflow in the receive_packet function in libusbmuxd/libusbmuxd.c in usbmuxd 1.0.5 through 1.0.7 allows physically proximate attackers to execute arbitrary code via a long SerialNumber field in a property list. http://git.marcansoft.com/?p=usbmuxd.git;a=commitdiff;h=f794991993af56a74795891b4ff9da506bc893e6 [oss-security] 20120119 CVE request: usbmuxd 1.0.7 "receive_packet()" Buffer Overflow Vulnerability [oss-security] 20120119 Re: CVE request: usbmuxd 1.0.7 "receive_packet()" Buffer Overflow Vulnerability MDVSA-2012:133 MDVSA-2013:133 51573 https://bugs.gentoo.org/show_bug.cgi?id=399409 usbmuxd-libusbmuxd-bo(72546) https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0228 Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in a (1) Accellent 5Views (aka .5vw) file, (2) I4B trace file, or (3) NETMON 2 capture file. http://anonsvn.wireshark.org/viewvc?view=revision&revision=40165 http://anonsvn.wireshark.org/viewvc?view=revision&revision=40166 RHSA-2013:0125 GLSA-201308-05 [oss-security] 20120111 Re: CVE request: Wireshark multiple vulnerabilities [oss-security] 20120119 Re: CVE request: Wireshark multiple vulnerabilities http://www.wireshark.org/security/wnpa-sec-2012-01.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6666 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6667 https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6669 oval:org.mitre.oval:def:15111 wiretap/iptrace.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in an AIX iptrace file. http://anonsvn.wireshark.org/viewvc?view=revision&revision=40167 RHSA-2013:0125 GLSA-201308-05 [oss-security] 20120111 Re: CVE request: Wireshark multiple vulnerabilities [oss-security] 20120119 Re: CVE request: Wireshark multiple vulnerabilities http://www.wireshark.org/security/wnpa-sec-2012-01.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6668 oval:org.mitre.oval:def:15192 The lanalyzer_read function in wiretap/lanalyzer.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a Novell capture file containing a record that is too small. http://anonsvn.wireshark.org/viewvc?view=revision&revision=40169 GLSA-201308-05 [oss-security] 20120111 Re: CVE request: Wireshark multiple vulnerabilities [oss-security] 20120119 Re: CVE request: Wireshark multiple vulnerabilities http://www.wireshark.org/security/wnpa-sec-2012-01.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6670 oval:org.mitre.oval:def:15379 SQL injection vulnerability in ajax.php in Batavi before 1.2.1 allows remote attackers to execute arbitrary SQL commands via the boxToReload parameter. http://voxel.dl.sourceforge.net/project/batavi/README.txt [oss-security] 20120118 CVE request - Batavi 1.2.1 Fixes Blind SQL Injection vulnerability in boxToReload parameter of ajax.php [oss-security] 20120119 Re: CVE request - Batavi 1.2.1 Fixes Blind SQL Injection 51547 batavi-ajax-sql-injection(72449) Unspecified vulnerability in the Oracle Imaging and Process Management component in Oracle Fusion Middleware 10.1.3.6.0 allows remote attackers to affect integrity via unknown vectors related to Web, a different vulnerability than CVE-2012-0093. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html Unspecified vulnerability in the Listener component in Oracle Database Server 10.1.0.5, 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, and 11.2.0.2 allows remote attackers to affect availability via unknown vectors. http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html 51458 1026527 databaseserver-listener-dos(72469) Unspecified vulnerability in the Oracle Forms component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via unknown vectors. http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html 51473 ebusiness-forms-cve20120073(72478) Unspecified vulnerability in the PeopleSoft Enterprise CRM component in Oracle PeopleSoft Products 8.9 allows remote authenticated users to affect integrity via unknown vectors related to Sales. http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html 51472 peoplesoft-enterprisecrm-cve20120074(72482) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x, 5.1.x, and 5.5.x allows remote authenticated users to affect integrity via unknown vectors. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659687 SUSE-SU-2012:0984 48250 GLSA-201308-06 DSA-2429 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html 51526 USN-1397-1 mysql-server-cve20120075(72539) Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.0 and 9.1 allows remote authenticated users to affect confidentiality via unknown vectors related to ePerformance. http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html 51474 peoplesoft-enthcm-info-disc(72484) Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 9.2.4, 10.0.2, 10.3.3, 10.3.4, and 10.3.5 allows remote authenticated users to affect integrity, related to WLS-Console. JVN#54779201 JVNDB-2012-000007 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html 51460 fusionmiddleware-weblogic-cve20120077(72477) Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.1.2 and 12.1.3 allows remote authenticated users to affect confidentiality, related to REST Services (Menu, LOV). http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html 51477 ebusiness-aol-info-disc(72479) Unspecified vulnerability in Oracle OpenSSO 7.1 and 8.0 allows remote attackers to affect integrity via unknown vectors related to Administration. RHSA-2012:1232 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html 51492 1026536 sun-opensso-cve20120079(72501) Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Talent Acquisition Management. http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html 51466 peoplesoft-enterprisehcm-cve20120080(72481) Unspecified vulnerability in Oracle GlassFish Enterprise Server 3.1.1 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Administration. http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html 51485 sun-glassfishenterpriseserver-cve20120081(72503) Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 10.1.0.5, 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote authenticated users to affect integrity and availability via unknown vectors. http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html 51453 1026527 databaseserver-corerdbms-cve20120082(72468) Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 7.5.2, 10.1.3.5.1, 11.1.1.3, 11.1.1.4, and 11.1.1.5 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Search. http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html 51451 fusionmiddleware-webcenter-cve20120083(72470) Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 7.5.2, 10.1.3.5.1, 11.1.1.3, 11.1.1.4, and 11.1.1.5 allows remote authenticated users to affect integrity via unknown vectors related to Content Server. http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html 51454 fusionmiddleware-webcenter-cve20120084(72476) Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 7.5.2 and 10.1.3.5.1 allows remote attackers to affect integrity via unknown vectors related to Content Server. http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html 51457 fusionmiddleware-webcenter-cve20120085(72475) Unspecified vulnerability in the Oracle Imaging and Process Management component in Oracle Fusion Middleware 10.1.3.6.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Web, a different vulnerability than CVE-2012-0095 and CVE-2012-0108. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x and 5.1.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0101 and CVE-2012-0102. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659687 SUSE-SU-2012:0984 48250 GLSA-201308-06 DSA-2429 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html 51509 USN-1397-1 mysql-serveruns-dos(72519) Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 8.9, 9.0, and 9.1 allows remote authenticated users to affect confidentiality via unknown vectors related to Benefits Administration. http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html 51480 peoplesoft-enterprisehcm-info-disc(72483) Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.1 allows remote authenticated users to affect confidentiality via unknown vectors related to ePerformance. http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html peoplesoft-enterhcm-info-disc(72485) Unspecified vulnerability in the Oracle Imaging and Process Management component in Oracle Fusion Middleware 10.1.3.6.0 allows remote authenticated users to affect integrity via unknown vectors related to Web, a different vulnerability than CVE-2012-0092. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52.05 allows remote authenticated users to affect integrity and availability via unknown vectors related to Upgrade Change Assistance. http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html peoplesoft-eptools-cve20120091(72486) Unspecified vulnerability in the Oracle Imaging and Process Management component in Oracle Fusion Middleware 10.1.3.6.0 allows remote authenticated users to affect integrity via unknown vectors related to Web, a different vulnerability than CVE-2012-0090. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html Unspecified vulnerability in the Oracle Imaging and Process Management component in Oracle Fusion Middleware 10.1.3.6.0 allows remote attackers to affect integrity via unknown vectors related to Web, a different vulnerability than CVE-2012-0071. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html Unspecified vulnerability in Oracle Solaris 9, 10, and 11 Express allows remote attackers to affect availability, related to TCP/IP. 48308 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html sun-solaris-dos(72495) Unspecified vulnerability in the Oracle Imaging and Process Management component in Oracle Fusion Middleware 10.1.3.6.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Web, a different vulnerability than CVE-2012-0086 and CVE-2012-0108. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html Unspecified vulnerability in Oracle Solaris 8, 9, 10, and 11 Express allows remote attackers to affect availability via unknown vectors related to Network. 48308 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html sun-solarisunspec-dos(72498) Unspecified vulnerability in Oracle Solaris 11 Express allows local users to affect confidentiality via unknown vectors related to ksh93 Shell. http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html sun-solaris-info-disc(72509) Unspecified vulnerability in Oracle Solaris 8, 9, 10, and 11 Express allows local users to affect availability via unknown vectors related to Kernel, a different vulnerability than CVE-2011-0813. 48308 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html sun-solarisunknown-dos(72510) Unspecified vulnerability in Oracle Solaris 9, 10, and 11 Express allows remote attackers to affect availability via unknown vectors related to sshd. 48308 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html sun-solarisunsp-dos(72506) Unspecified vulnerability in Oracle Solaris 9, 10, and 11 Express allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Kerberos. 48308 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html sun-solaris-cve20120100(72496) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x and 5.1.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0087 and CVE-2012-0102. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659687 SUSE-SU-2012:0984 48250 GLSA-201308-06 DSA-2429 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html USN-1397-1 mysql-serveruns1-dos(72520) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x and 5.1.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0087 and CVE-2012-0101. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659687 SUSE-SU-2012:0984 48250 GLSA-201308-06 DSA-2429 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html USN-1397-1 mysql-serveruns2-dos(72521) Unspecified vulnerability in Oracle Solaris 11 Express allows local users to affect availability via unknown vectors related to Kernel. http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html sun-solarisunspecified-dos(72499) Unspecified vulnerability in Oracle GlassFish Enterprise Server 3.0.1 and 3.1.1 allows remote attackers to affect availability via unknown vectors related to Web Container. http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html sun-glassfishenterpriseserver-dos(72497) Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization 4.1 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Windows Guest Additions. openSUSE-SU-2012:1323 GLSA-201204-01 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html virtualization-vmvirtualbox-cve20120105(72511) oval:org.mitre.oval:def:16235 Unspecified vulnerability in the Oracle Imaging and Process Management component in Oracle Fusion Middleware 10.1.3.6.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Web. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html Unspecified vulnerability in the Oracle Imaging and Process Management component in Oracle Fusion Middleware 10.1.3.6.0 allows remote attackers to affect availability via unknown vectors related to Web. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html Unspecified vulnerability in the Oracle Imaging and Process Management component in Oracle Fusion Middleware 10.1.3.6.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Web, a different vulnerability than CVE-2012-0086 and CVE-2012-0095. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html Unspecified vulnerability in Oracle Solaris 8, 9, 10, and 11 Express allows local users to affect confidentiality and availability, related to TCP/IP. 48308 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html sun-solaris-cve20120109(72504) Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.5 and 8.3.7 allows context-dependent attackers to affect confidentiality, integrity, and availability, related to Outside In Image Export SDK. http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html 51452 http://www-01.ibm.com/support/docview.wss?uid=swg21660640 Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization 4.1 allows local users to affect confidentiality and integrity via unknown vectors related to Shared Folders. openSUSE-SU-2012:1323 GLSA-201204-01 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html oval:org.mitre.oval:def:16722 Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0115, CVE-2012-0119, CVE-2012-0120, CVE-2012-0485, and CVE-2012-0492. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659687 48250 GLSA-201308-06 DSA-2429 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html USN-1397-1 Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect confidentiality and availability via unknown vectors, a different vulnerability than CVE-2012-0118. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659687 48250 GLSA-201308-06 DSA-2429 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html USN-1397-1 Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x, 5.1.x, and 5.5.x allows local users to affect confidentiality and integrity via unknown vectors. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659687 SUSE-SU-2012:0984 48250 GLSA-201308-06 DSA-2429 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html USN-1397-1 Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0112, CVE-2012-0119, CVE-2012-0120, CVE-2012-0485, and CVE-2012-0492. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659687 48250 GLSA-201308-06 DSA-2429 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html USN-1397-1 Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect confidentiality and integrity via unknown vectors. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659687 48250 GLSA-201308-06 DSA-2429 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html USN-1397-1 Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0486, CVE-2012-0487, CVE-2012-0488, CVE-2012-0489, CVE-2012-0491, CVE-2012-0493, and CVE-2012-0495. GLSA-201308-06 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html USN-1397-1 Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect confidentiality and availability via unknown vectors, a different vulnerability than CVE-2012-0113. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659687 48250 GLSA-201308-06 DSA-2429 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html USN-1397-1 Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0112, CVE-2012-0115, CVE-2012-0120, CVE-2012-0485, and CVE-2012-0492. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659687 48250 GLSA-201308-06 DSA-2429 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html USN-1397-1 Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0112, CVE-2012-0115, CVE-2012-0119, CVE-2012-0485, and CVE-2012-0492. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659687 48250 GLSA-201308-06 DSA-2429 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html USN-1397-1 Unspecified vulnerability in HP Data Protector Express (aka DPX) 5.0.00 before build 59287 and 6.0.00 before build 11974 allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1392. SSRT100781 Unspecified vulnerability in HP Data Protector Express (aka DPX) 5.0.00 before build 59287 and 6.0.00 before build 11974 allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1393. SSRT100781 Unspecified vulnerability in HP Data Protector Express (aka DPX) 5.0.00 before build 59287 and 6.0.00 before build 11974 allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors, aka ZDI-CAN-1498. SSRT100781 hp-dataprotector-code-execution(73947) Unspecified vulnerability in HP Data Protector Express (aka DPX) 5.0.00 before build 59287 and 6.0.00 before build 11974 allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors. SSRT100781 Unspecified vulnerability in the WBEM implementation in HP HP-UX 11.31 allows local users to obtain access to diagnostic information via unknown vectors, a related issue to CVE-2012-0126. SSRT100667 52733 1026849 hpux-wbem-sec-bypass(74391) Unspecified vulnerability in the WBEM implementation in HP HP-UX 11.11 and 11.23 allows remote attackers to obtain access to diagnostic information via unknown vectors, a related issue to CVE-2012-0125. SSRT100667 52734 1026849 hpux-wbem-security-bypass(74390) Unspecified vulnerability in HP Performance Manager 9.00 allows remote attackers to execute arbitrary code via unknown vectors. 48586 SSRT100596 52749 1026869 hp-performance-code-exec(74406) HP Onboard Administrator (OA) before 3.50 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. SSRT100817 52862 1026889 hpoa-unspecified-open-redirect(74575) HP Onboard Administrator (OA) before 3.50 allows remote attackers to bypass intended access restrictions and execute arbitrary code via unspecified vectors. SSRT100817 52862 1026889 hpoa-unspecified-unauth-access(74576) HP Onboard Administrator (OA) before 3.50 allows remote attackers to obtain sensitive information via unspecified vectors. SSRT100817 52862 1026889 hpoa-unspecified-info-disclosure(74577) Distributed Computing Environment (DCE) 1.8 and 1.9 on HP HP-UX B.11.11 and B.11.23 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. HPSBUX02758 52860 1026885 hpux-unspec-dce-dos(74800) oval:org.mitre.oval:def:19280 Cross-site scripting (XSS) vulnerability in HP Business Availability Center (BAC) 9.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. SSRT100793 52880 hp-bac-unspec-xss(74640) HP ProCurve 5400 zl switches with certain serial numbers include a compact flash card that contains an unspecified virus, which might allow user-assisted remote attackers to execute arbitrary code on a PC by leveraging manual transfer of this card. SSRT100803 1026916 hpprocurve-flashcards-weak-security(74819) Unspecified vulnerability in HP OpenVMS 7.3-2 on the Alpha platform, 8.3 and 8.4 on the Alpha and IA64 platforms, and 8.3-1h1 on the IA64 platform allows local users to cause a denial of service via unknown vectors. SSRT100828 1026935 Unspecified vulnerability in HP System Management Homepage (SMH) before 7.0 allows remote authenticated users to cause a denial of service via unknown vectors. HPSBMU02764 1026925 hp-system-homepage-dos(74917) Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execute arbitrary code via crafted attributes in a Visio file, aka "VSD File Format Memory Corruption Vulnerability," a different vulnerability than CVE-2012-0019, CVE-2012-0020, CVE-2012-0137, and CVE-2012-0138. TA12-045A MS12-015 oval:org.mitre.oval:def:14924 Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execute arbitrary code via crafted attributes in a Visio file, aka "VSD File Format Memory Corruption Vulnerability," a different vulnerability than CVE-2012-0019, CVE-2012-0020, CVE-2012-0136, and CVE-2012-0138. TA12-045A MS12-015 oval:org.mitre.oval:def:14602 Microsoft Visio Viewer 2010 Gold and SP1 does not properly handle memory during the parsing of files, which allows remote attackers to execute arbitrary code via crafted attributes in a Visio file, aka "VSD File Format Memory Corruption Vulnerability," a different vulnerability than CVE-2012-0019, CVE-2012-0020, CVE-2012-0136, and CVE-2012-0137. TA12-045A MS12-015 oval:org.mitre.oval:def:14811 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012. Notes: none. Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2011 for Mac; Excel Viewer; and Office Compatibility Pack SP2 and SP3 do not properly handle memory during the opening of files, which allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Excel File Format Memory Corruption Vulnerability." 53342 1027041 TA12-129A MS12-030 oval:org.mitre.oval:def:15152 Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2008 for Mac; Excel Viewer; and Office Compatibility Pack SP2 and SP3 do not properly handle memory during the opening of files, which allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Excel File Format Memory Corruption in OBJECTLINK Record Vulnerability." 53373 1027041 TA12-129A MS12-030 oval:org.mitre.oval:def:15543 Microsoft Excel 2003 SP3 and Office 2008 for Mac do not properly handle memory during the opening of files, which allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Excel Memory Corruption Using Various Modified Bytes Vulnerability." 53374 1027041 TA12-129A MS12-030 oval:org.mitre.oval:def:15064 Cross-site scripting (XSS) vulnerability in themeweb.aspx in Microsoft Office SharePoint Server 2010 Gold and SP1 and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via JavaScript sequences in a URL, aka "XSS in themeweb.aspx Vulnerability." TA12-045A MS12-011 oval:org.mitre.oval:def:14386 Cross-site scripting (XSS) vulnerability in wizardlist.aspx in Microsoft Office SharePoint Server 2010 Gold and SP1 and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via JavaScript sequences in a URL, aka "XSS in wizardlist.aspx Vulnerability." TA12-045A MS12-011 oval:org.mitre.oval:def:14826 Open redirect vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 SP1 and SP1 Update 1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL, aka "UAG Blind HTTP Redirect Vulnerability." 52903 1026909 MS12-026 ms-forefront-spoofing(74367) oval:org.mitre.oval:def:15476 Microsoft Forefront Unified Access Gateway (UAG) 2010 SP1 and SP1 Update 1 does not properly configure the default web site, which allows remote attackers to obtain sensitive information via a crafted HTTPS request, aka "Unfiltered Access to UAG Default Website Vulnerability." 52909 1026909 TA12-101A MS12-026 ms-forefront-uag-info-disclosure(74368) oval:org.mitre.oval:def:15557 afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 on 64-bit platforms does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "AfdPoll Elevation of Privilege Vulnerability." Per: http://technet.microsoft.com/en-us/security/bulletin/ms12-009 'This vulnerability is not exploitable on 32-bit editions of Microsoft Windows.' TA12-045A MS12-009 oval:org.mitre.oval:def:14852 afd.sys in the Ancillary Function Driver in Microsoft Windows Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability." TA12-045A MS12-009 oval:org.mitre.oval:def:14958 Buffer overflow in msvcrt.dll in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted media file, aka "Msvcrt.dll Buffer Overflow Vulnerability." TA12-045A MS12-013 oval:org.mitre.oval:def:14631 The Authenticode Signature Verification function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview does not properly validate the digest of a signed portable executable (PE) file, which allows user-assisted remote attackers to execute arbitrary code via a modified file with additional content, aka "WinVerifyTrust Signature Validation Vulnerability." 1026906 TA12-101A MS12-024 oval:org.mitre.oval:def:15594 The Remote Desktop Protocol (RDP) service in Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote attackers to cause a denial of service (application hang) via a series of crafted packets, aka "Terminal Server Denial of Service Vulnerability." 52354 1026790 TA12-073A MS12-020 oval:org.mitre.oval:def:14626 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012. Notes: none. Use-after-free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that triggers keyboard layout errors, aka "Keyboard Layout Use After Free Vulnerability." TA12-045A MS12-008 oval:org.mitre.oval:def:14928 Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "VML Remote Code Execution Vulnerability." TA12-045A MS12-010 oval:org.mitre.oval:def:14781 DirectWrite in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly render Unicode characters, which allows remote attackers to cause a denial of service (application hang) via a (1) instant message or (2) web site, aka "DirectWrite Application Denial of Service Vulnerability." 80003 MS12-019 oval:org.mitre.oval:def:14807 win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle window messaging, which allows local users to gain privileges via a crafted application that calls the PostMessage function, aka "PostMessage Function Vulnerability." 80002 TA12-073A MS12-018 oval:org.mitre.oval:def:14217 The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2003 Web Components SP3; SQL Server 2000 SP4, 2005 SP4, and 2008 SP2, SP3, and R2; BizTalk Server 2002 SP1; Commerce Server 2002 SP4, 2007 SP2, and 2009 Gold and R2; Visual FoxPro 8.0 SP1 and 9.0 SP2; and Visual Basic 6.0 Runtime allow remote attackers to execute arbitrary code via a crafted (a) web site, (b) Office document, or (c) .rtf file that triggers "system state" corruption, as exploited in the wild in April 2012, aka "MSCOMCTL.OCX RCE Vulnerability." http://opensources.info/comment-on-the-curious-case-of-a-cve-2012-0158-exploit-by-chris-pierce/ 52911 1026899 1026900 1026902 1026903 1026904 1026905 TA12-101A MS12-027 ms-activex-control-code-execution(74372) oval:org.mitre.oval:def:15462 Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview; Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Silverlight 4 before 4.1.10329; and Silverlight 5 before 5.1.10411 allow remote attackers to execute arbitrary code via a crafted TrueType font (TTF) file, aka "TrueType Font Parsing Vulnerability." 53335 1027039 TA12-129A TA12-164A MS12-034 MS12-039 microsoft-truetype-code-exec(75124) oval:org.mitre.oval:def:15388 oval:org.mitre.oval:def:15667 Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5 SP1, 3.5.1, and 4 does not properly serialize input data, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application, aka ".NET Framework Serialization Vulnerability." 53356 1027036 TA12-129A MS12-035 oval:org.mitre.oval:def:15554 Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5 SP1, 3.5.1, and 4 does not properly handle an unspecified exception during use of partially trusted assemblies to serialize input data, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application, aka ".NET Framework Serialization Vulnerability." 53357 1027036 TA12-129A MS12-035 oval:org.mitre.oval:def:14951 Microsoft .NET Framework 4 does not properly allocate buffers, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application, aka ".NET Framework Buffer Allocation Vulnerability." 53358 TA12-129A MS12-034 oval:org.mitre.oval:def:14655 Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate function parameters, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP), (2) a crafted ASP.NET application, or (3) a crafted .NET Framework application, aka ".NET Framework Parameter Validation Vulnerability." 1026907 TA12-101A MS12-025 ms-dotnet-parameter-code-exec(74377) oval:org.mitre.oval:def:15495 Microsoft .NET Framework 4 does not properly compare index values, which allows remote attackers to cause a denial of service (application hang) via crafted requests to a Windows Presentation Foundation (WPF) application, aka ".NET Framework Index Comparison Vulnerability." 53363 MS12-034 oval:org.mitre.oval:def:15580 GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2 and Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1 does not properly validate record types in EMF images, which allows remote attackers to execute arbitrary code via a crafted image, aka "GDI+ Record Type Vulnerability." 53347 1027038 TA12-129A MS12-034 windows-gdi-emf-code-exec(75125) oval:org.mitre.oval:def:15621 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012. Notes: none. Heap-based buffer overflow in the Office GDI+ library in Microsoft Office 2003 SP3 and 2007 SP2 and SP3 allows remote attackers to execute arbitrary code via a crafted EMF image in an Office document, aka "GDI+ Heap Overflow Vulnerability." 53351 1027038 TA12-129A MS12-034 windows-gdi-emf-bo(75126) oval:org.mitre.oval:def:15628 Microsoft Internet Explorer 6 through 9 allows user-assisted remote attackers to execute arbitrary code via a crafted HTML document that is not properly handled during a "Print table of links" print operation, aka "Print Feature Remote Code Execution Vulnerability." 1026901 MS12-023 ie-html-page-code-exec(74379) oval:org.mitre.oval:def:15577 Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "JScript9 Remote Code Execution Vulnerability." 52902 1026901 TA12-101A MS12-023 ms-ie-jscript9-code-exec(74380) oval:org.mitre.oval:def:15611 Microsoft Internet Explorer 6 and 7 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "OnReadyStateChange Remote Code Execution Vulnerability." 1026901 TA12-101A MS12-023 ms-ie-onreadystatechange-code-exec(74381) oval:org.mitre.oval:def:15573 Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "SelectAll Remote Code Execution Vulnerability." 1026901 TA12-101A MS12-023 ms-ie-selectall-code-exec(74382) oval:org.mitre.oval:def:15313 Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "VML Style Remote Code Execution Vulnerability." 1026901 TA12-101A MS12-023 ms-ie-vml-code-exec(74383) oval:org.mitre.oval:def:15550 The Remote Desktop Protocol (RDP) implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly process packets in memory, which allows remote attackers to execute arbitrary code by sending crafted RDP packets triggering access to an object that (1) was not properly initialized or (2) is deleted, aka "Remote Desktop Protocol Vulnerability," a different vulnerability than CVE-2012-0002. TA12-164A MS12-036 oval:org.mitre.oval:def:15116 Windows Firewall in tcpip.sys in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly enforce firewall rules for outbound broadcast packets, which allows remote attackers to obtain potentially sensitive information by observing broadcast traffic on a local network, aka "Windows Firewall Bypass Vulnerability." Per http://technet.microsoft.com/en-us/security/bulletin/ms12-032 "An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability." "In order to use this vulnerability, an attacker would first have to gain access to the local subnet of the target computer. An attacker could then use another vulnerability to acquire information about the target system or execute code on the target system." 53352 1027044 TA12-129A MS12-032 ms-win-broadcast-sec-bypass(75128) oval:org.mitre.oval:def:15160 The Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted name for a (1) file or (2) directory, aka "Command Injection Vulnerability." TA12-192A MS12-048 oval:org.mitre.oval:def:14897 Double free vulnerability in Microsoft Silverlight 4 before 4.1.10329 on Windows allows remote attackers to execute arbitrary code via vectors involving crafted XAML glyphs, aka "Silverlight Double-Free Vulnerability." 53360 1027040 TA12-129A MS12-034 oval:org.mitre.oval:def:15574 Heap-based buffer overflow in the Office Works File Converter in Microsoft Office 2007 SP2, Works 9, and Works 6-9 File Converter allows remote attackers to execute arbitrary code via a crafted Works (aka .wps) file, aka "Office WPS Converter Heap Overflow Vulnerability." 52867 1026910 1026911 TA12-101A MS12-028 oval:org.mitre.oval:def:15598 Race condition in partmgr.sys in Windows Partition Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that makes multiple simultaneous Plug and Play (PnP) Configuration Manager function calls, aka "Plug and Play (PnP) Configuration Manager Vulnerability." 53378 1027043 TA12-129A MS12-033 oval:org.mitre.oval:def:15229 Double free vulnerability in tcpip.sys in Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that binds an IPv6 address to a local interface, aka "TCP/IP Double Free Vulnerability." 53349 1027044 TA12-129A MS12-032 oval:org.mitre.oval:def:14908 win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview does not properly handle user-mode input passed to kernel mode for (1) windows and (2) messages, which allows local users to gain privileges via a crafted application, aka "Windows and Messages Vulnerability." 53324 1027039 TA12-129A MS12-034 oval:org.mitre.oval:def:15466 win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview does not properly manage Keyboard Layout files, which allows local users to gain privileges via a crafted application, aka "Keyboard Layout File Vulnerability." 1027039 TA12-129A MS12-034 oval:org.mitre.oval:def:15355 Microsoft Word 2007 SP2 and SP3 does not properly handle memory during the parsing of Word documents, which allows remote attackers to execute arbitrary code via a crafted document, aka "Word PAPX Section Corruption Vulnerability." 55780 TA12-283A MS12-064 oval:org.mitre.oval:def:15426 Microsoft Word 2003 SP3 and 2007 SP2 and SP3, Office 2008 and 2011 for Mac, and Office Compatibility Pack SP2 and SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data, aka "RTF Mismatch Vulnerability." 53344 1027035 TA12-129A MS12-029 microsoft-office-rtf-code-execution(75122) oval:org.mitre.oval:def:15327 Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2008 and 2011 for Mac; Excel Viewer; and Office Compatibility Pack SP2 and SP3 do not properly handle memory during the opening of files, which allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Excel SXLI Record Memory Corruption Vulnerability." 53375 1027041 TA12-129A 20120508 Microsoft Excel SXLI Record Memory Corruption Vulnerability MS12-030 ms-excel-sxli-code-execution(75117) oval:org.mitre.oval:def:14789 Heap-based buffer overflow in Microsoft Excel 2007 SP2 and SP3 and 2010 Gold and SP1, Excel Viewer, and Office Compatibility Pack SP2 and SP3 allows remote attackers to execute arbitrary code via a crafted spreadsheet that triggers incorrect handling of memory during opening, aka "Excel MergeCells Record Heap Overflow Vulnerability." 1027041 TA12-129A MS12-030 ms-excel-mergecells-bo(75118) oval:org.mitre.oval:def:14738 Directory traversal vulnerability in the Eclipse Help component in IBM Lotus Expeditor 6.1.x and 6.2.x before 6.2 FP5+Security Pack allows remote attackers to discover the locations of files via a crafted URL. http://www.ibm.com/support/docview.wss?uid=swg21575642 lotusexpeditor-ehelp-dir-traversal(72096) Untrusted search path vulnerability in IBM Lotus Expeditor 6.1.x and 6.2.x before 6.2 FP5+Security Pack allows local users to gain privileges via a Trojan horse DLL in the current working directory. Per: http://cwe.mitre.org/data/definitions/426.html 'CWE-426: Untrusted Search Path' http://www.ibm.com/support/docview.wss?uid=swg21575642 lotusexpeditor-dll-code-execution(72097) Unspecified vulnerability in the SetLicenseInfoEx method in an ActiveX control in mraboutb.dll in IBM SPSS Dimensions 5.5 and SPSS Data Collection 5.6, 6.0, and 6.0.1 allows remote attackers to execute arbitrary code via a crafted HTML document. http://www-01.ibm.com/support/docview.wss?uid=swg21577956 spss-mraboutb-activex-code-execution(72118) Multiple unspecified vulnerabilities in the (1) PrintFile and (2) SaveDoc methods in the VsVIEW6 ActiveX control in VsVIEW6.ocx in IBM SPSS SamplePower 3.0 allow remote attackers to execute arbitrary code via a crafted HTML document. http://www.ibm.com/support/docview.wss?uid=swg21577951 spss-vsview6-activex-code-execution(72119) Unspecified vulnerability in the Render method in the ExportHTML.ocx ActiveX control in ExportHTML.dll in IBM SPSS Dimensions 5.5 and SPSS Data Collection 5.6, 6.0, and 6.0.1 allows remote attackers to execute arbitrary code via a crafted HTML document. http://www-01.ibm.com/support/docview.wss?uid=swg21577956 spss-wxporthtml-activex-code-execution(72121) The web container in IBM Lotus Expeditor 6.1.x and 6.2.x before 6.2 FP5+Security Pack does not properly perform access control for requests, which allows remote attackers to spoof a localhost request origin via crafted headers. http://www.ibm.com/support/docview.wss?uid=swg21575642 lotusexpeditor-acm-security-bypass(72156) Multiple integer overflows in vclmi.dll in the visual class library module in IBM Lotus Symphony before 3.0.1 might allow remote attackers to execute arbitrary code via an embedded (1) JPEG or (2) PNG image object in a Symphony document that triggers a heap-based buffer overflow, as demonstrated by a .doc file. 51591 http://www-01.ibm.com/support/docview.wss?uid=swg21578684 lotus-symphony-vclmi-bo(72424) IBM WebSphere Application Server (WAS) 6.0 through 6.0.2.43, 6.1 before 6.1.0.43, 7.0 before 7.0.0.23, and 8.0 before 8.0.0.3 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. PM53930 http://www-01.ibm.com/support/docview.wss?uid=swg21577532 http://www-01.ibm.com/support/docview.wss?uid=swg24031821 The TCP implementation in IBM AIX 5.3, 6.1, and 7.1, when the Large Send Offload option is enabled, allows remote attackers to cause a denial of service (assertion failure and panic) via an unspecified series of packets. http://aix.software.ibm.com/aix/efixes/security/large_send_advisory.asc 1026640 IV13751 IV13820 IV13827 IV14209 IV14210 IV14211 51864 aix-tcpstack-dos(72562) Cross-site scripting (XSS) vulnerability in the Start Center Layout and Configuration component in IBM Maximo Asset Management and Asset Management Essentials 6.2, 7.1, and 7.5; IBM Tivoli Asset Management for IT 6.2, 7.1, and 7.2; IBM Tivoli Service Request Manager 7.1 and 7.2; IBM Maximo Service Desk 6.2; and IBM Tivoli Change and Configuration Management Database (CCMDB) 6.2, 7.1, and 7.2 allows remote attackers to inject arbitrary web script or HTML via the display name. 48299 48305 http://www.ibm.com/support/docview.wss?uid=swg21584666 52333 IV09198 mam-sclc-xss(72612) Stack-based buffer overflow in the RunAndUploadFile method in the Isig.isigCtl.1 ActiveX control in IBM Tivoli Provisioning Manager Express for Software Distribution 4.1.1 allows remote attackers to execute arbitrary code via vectors related to an Asset Information file. http://www.zerodayinitiative.com/advisories/ZDI-12-040/ tpme-isigisigctl1-bo(73033) Multiple SQL injection vulnerabilities in IBM Tivoli Provisioning Manager Express for Software Distribution 4.1.1 allow remote attackers to execute arbitrary SQL commands via (1) a SOAP message to the Printer.getPrinterAgentKey function in the SoapServlet servlet, (2) the User.updateUserValue function in the register.do servlet, (3) the User.isExistingUser function in the logon.do servlet, (4) the Asset.getHWKey function in the CallHomeExec servlet, (5) the Asset.getMimeType function in the getAttachment (aka GetAttachmentServlet) servlet, (6) the addAsset.do servlet, or (7) a crafted EG2 file. http://www.zerodayinitiative.com/advisories/ZDI-12-040/ tpme-multiple-sql-injection(73034) The server in IBM solidDB 6.5 before Interim Fix 6 does not properly initialize data structures, which allows remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with a redundant WHERE condition. http://www.ibm.com/support/docview.wss?uid=swg27021052 IC81244 soliddb-redundant-where-dos(73126) Stack-based buffer overflow in pcspref.dll in pcsws.exe in IBM Personal Communications 5.9.x before 5.9.8 and 6.0.x before 6.0.4 might allow remote attackers to execute arbitrary code via a long profile string in a WorkStation (aka .ws) file. http://dev.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/fileformat/ibm_pcm_ws.rb 18539 http://www.metasploit.com/modules/exploit/windows/fileformat/ibm_pcm_ws http://www.stratsec.net/Research/Advisories/IBM-Personal-Communications-I-Series-Access-WorkSt IC81539 http://www-01.ibm.com/support/docview.wss?uid=swg21586166 pcom-pcspref-bo(73127) Multiple stack-based buffer overflows in tm1admsd.exe in the Admin Server in IBM Cognos TM1 9.4.x and 9.5.x before 9.5.2 FP2 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via crafted data. http://www-01.ibm.com/support/docview.wss?uid=swg21590314 http://www-01.ibm.com/support/docview.wss?uid=swg24032164 http://www-01.ibm.com/support/docview.wss?uid=swg24032165 http://www-01.ibm.com/support/docview.wss?uid=swg24032166 cognos-tm1admsd-bo(73182) Cross-site scripting (XSS) vulnerability in InfoSphere Metadata Workbench (MWB) 8.1 through 8.7 in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://www-01.ibm.com/support/docview.wss?uid=swg21623501 infosphere-mw-xss(73254) Untrusted search path vulnerability in InfoSphere Import Export Manager 8.1 through 9.1 in InfoSphere Information Server MetaBrokers & Bridges (MBB) in IBM InfoSphere Information Server 8.1, 8.5 before FP3, 8.7, and 9.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory. Per: http://cwe.mitre.org/data/definitions/426.html 'CWE-426 Untrusted Search Path' Per: http://www-01.ibm.com/support/docview.wss?uid=swg21623501 "CVSS Base Score: 9.3 / CVSS Vector: (AV:N/AC:M/Au:N/C:C/I:C/A:C) a malicious user who has access to a machine with the Import Export Manager installed could execute arbitrary commands in the context of any user who accesses the Import Export Manager application. " http://www-01.ibm.com/support/docview.wss?uid=swg21623501 infosphere-is-dll-code-execution(73255) InfoSphere Metadata Workbench (MWB) 8.1 through 8.7 in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 does not properly restrict use of the troubleshooting feature, which allows remote authenticated users to bypass intended access restrictions or cause a denial of service (workbench outage) via unspecified vectors. http://www-01.ibm.com/support/docview.wss?uid=swg21623501 infosphere-mw-ts-security-bypass(73265) common_startup.cc in PowerDNS (aka pdns) Authoritative Server before 2.9.22.5 and 3.x before 3.0.1 allows remote attackers to cause a denial of service (packet loop) via a crafted UDP DNS response. http://doc.powerdns.com/changelog.html http://doc.powerdns.com/powerdns-advisory-2012-01.html https://bugzilla.redhat.com/show_bug.cgi?id=772570 The igmp_heard_query function in net/ipv4/igmp.c in the Linux kernel before 3.2.1 allows remote attackers to cause a denial of service (divide-by-zero error and panic) via IGMP packets. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=654876 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a8c1f65c79cbbb2f7da782d4c9d15639a9b94b27 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.1 [oss-security] 20120110 CVE-2012-0207 kernel: igmp: Avoid zero delay when receiving odd mixture of IGMP queries https://bugzilla.redhat.com/show_bug.cgi?id=772867 https://github.com/torvalds/linux/commit/25c413ad0029ea86008234be28aee33456e53e5b https://github.com/torvalds/linux/commit/a8c1f65c79cbbb2f7da782d4c9d15639a9b94b27 Unspecified vulnerability in the Oracle Grid Engine component in Oracle Sun Products Suite 6.1 and 6.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to qrsh. DSA-2472 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 1026950 Horde 3.3.12, Horde Groupware 1.2.10, and Horde Groupware Webmail Edition 1.2.10, as distributed by FTP between November 2011 and February 2012, contains an externally introduced modification (Trojan Horse) in templates/javascript/open_calendar.js, which allows remote attackers to execute arbitrary PHP code. http://dev.horde.org/h/jonah/stories/view.php?channel_id=1&id=155 http://eromang.zataz.com/2012/02/15/cve-2012-0209-horde-backdoor-analysis/ [horde-announce] 20120213 [SECURITY] Remote execution backdoor after server hack (CVE-2012-0209) http://packetstormsecurity.org/files/109874/Horde-3.3.12-Backdoor-Arbitrary-PHP-Code-Execution.html https://bugzilla.redhat.com/show_bug.cgi?id=790877 debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to obtain system information and execute arbitrary code via the file name in a (1) .dsc or (2) .changes file. http://anonscm.debian.org/gitweb/?p=devscripts/devscripts.git;a=commitdiff;h=797ddc961532eb0aeb46153e3f28c8e9ea0500d2 USN-1366-1 DSA-2409 52029 devscripts-dsc-code-execution(73215) debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to execute arbitrary code via a crafted tarball file name in the top-level directory of an original (.orig) source tarball of a source package. http://anonscm.debian.org/gitweb/?p=devscripts/devscripts.git;a=commitdiff;h=87f88232eb643f0c118c6ba38db8e966915b450f http://anonscm.debian.org/gitweb/?p=devscripts/devscripts.git;a=commitdiff;h=9cbe605d3eab4f9e67525f69b676c55b273b7a03 USN-1366-1 DSA-2409 52029 devscripts-commands-code-execution(73216) debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to execute arbitrary code via shell metacharacters in the file name argument. http://anonscm.debian.org/gitweb/?p=devscripts/devscripts.git;a=commitdiff;h=9cbe605d3eab4f9e67525f69b676c55b273b7a03 USN-1366-1 DSA-2409 52029 USN-1593-1 devscripts-debdiff-code-execution(73217) The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache POI 3.8 and earlier allows remote attackers to cause a denial of service (OutOfMemoryError exception and possibly JVM destabilization) via a crafted length value in a Channel Definition Format (CDF) or Compound File Binary Format (CFBF) document. FEDORA-2012-10835 RHSA-2012:1232 DSA-2468 MDVSA-2013:094 53487 http://www-01.ibm.com/support/docview.wss?uid=swg21996759 https://bugzilla.redhat.com/show_bug.cgi?id=799078 https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0044 The pkgAcqMetaClearSig::Failed method in apt-pkg/acquire-item.cc in Advanced Package Tool (APT) 0.8.11 through 0.8.15.10 and 0.8.16 before 0.8.16~exp13, when updating from repositories that use InRelease files, allows man-in-the-middle attackers to install arbitrary packages by preventing a user from downloading the new InRelease file, which leaves the original InRelease file active and makes it more difficult to detect that the Packages file is modified and unsigned. http://anonscm.debian.org/gitweb/?p=apt/apt.git;a=commitdiff;h=b7a6594d1e5ed199a7a472b78b33e070375d6f92 http://anonscm.debian.org/gitweb/?p=apt/apt.git;a=commitdiff;h=de498a528cd6fc36c4bb22bf8dec6558e21cc9b6 USN-1385-1 model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2) write, (3) delete, or (4) copy rpc call. http://hg.tryton.org/trytond/rev/8e64d52ecea4 http://news.tryton.org/2012/03/security-releases-for-all-supported.html DSA-2444 https://bugs.tryton.org/issue2476 The default configuration of the apache2 package in Debian GNU/Linux squeeze before 2.2.16-6+squeeze7, wheezy before 2.2.22-4, and sid before 2.2.22-4, when mod_php or mod_rivet is used, provides example scripts under the doc/ URI, which might allow local users to conduct cross-site scripting (XSS) attacks, gain privileges, or obtain sensitive information via vectors involving localhost HTTP requests to the Apache HTTP Server. DSA-2452 gnulinux-apache2-xss(75211) The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier. Per: http://technet.microsoft.com/en-us/security/bulletin/ms12-042 'This vulnerability only affects Intel x64-based versions of Windows 7 and Windows Server 2008 R2. Systems with AMD or ARM-based CPUs are not affected by this vulnerability.' http://blog.illumos.org/2012/06/14/illumos-vulnerability-patched/ http://blog.xen.org/index.php/2012/06/13/the-intel-sysret-privilege-escalation/ NetBSD-SA2012-003 [xen-announce] 20120612 Xen Security Advisory 7 (CVE-2012-0217) - PV privilege escalation [xen-devel] 20120619 Security vulnerability process, and CVE-2012-0217 FreeBSD-SA-12:04 GLSA-201309-24 http://smartos.org/2012/06/15/smartos-news-3/ http://support.citrix.com/article/CTX133161 http://wiki.smartos.org/display/DOC/SmartOS+Change+Log#SmartOSChangeLog-June14%2C2012 DSA-2501 DSA-2508 VU#649219 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html TA12-164A https://bugzilla.redhat.com/show_bug.cgi?id=813428 MS12-042 oval:org.mitre.oval:def:15596 28718 46508 https://www.illumos.org/issues/2873 Xen 3.4, 4.0, and 4.1, when the guest OS has not registered a handler for a syscall or sysenter instruction, does not properly clear a flag for exception injection when injecting a General Protection Fault, which allows local PV guest OS users to cause a denial of service (guest crash) by later triggering an exception that would normally be handled within Xen. [Xen-announce] 20120612 Xen Security Advisory 8 (CVE-2012-0218) - syscall/enter guest DoS GLSA-201309-24 DSA-2501 Heap-based buffer overflow in the xioscan_readline function in xio-readline.c in socat 1.4.0.0 through 1.7.2.0 and 2.0.0-b1 through 2.0.0-b4 allows local users to execute arbitrary code via the READLINE address. FEDORA-2012-8274 FEDORA-2012-8328 GLSA-201208-01 http://www.dest-unreach.org/socat/contrib/socat-secadv3.html openSUSE-SU-2012:0809 MDVSA-2013:169 [oss-security] 20120514 socat security advisory 53510 1027064 Multiple cross-site scripting (XSS) vulnerabilities in the meta plugin (Plugin/meta.pm) in ikiwiki before 3.20120516 allow remote attackers to inject arbitrary web script or HTML via the (1) author or (2) authorurl meta tags. http://ikiwiki.info/news/version_3.20120516/ http://source.ikiwiki.branchable.com/?p=source.git;a=commitdiff;h=fbfcea89f8e06426c73ab8ea369ca4cdc566db6f DSA-2474 53599 ikiwiki-unspecified-xss(75702) The FactoryTalk (FT) RNADiagReceiver service in Rockwell Automation Allen-Bradley FactoryTalk CPR9 through SR5 and RSLogix 5000 17 through 20 does not properly handle the return value from an unspecified function, which allows remote attackers to cause a denial of service (service outage) via a crafted packet. http://rockwellautomation.custhelp.com/app/answers/detail/a_id/469937 http://www.us-cert.gov/control_systems/pdf/ICSA-12-088-01.pdf The FactoryTalk (FT) RNADiagReceiver service in Rockwell Automation Allen-Bradley FactoryTalk CPR9 through SR5 and RSLogix 5000 17 through 20 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted packet. http://rockwellautomation.custhelp.com/app/answers/detail/a_id/469937 http://www.us-cert.gov/control_systems/pdf/ICSA-12-088-01.pdf Untrusted search path vulnerability in 7-Technologies (7T) TERMIS 2.10 and earlier allows local users to gain privileges via a Trojan horse DLL in the current working directory, a different vulnerability than CVE-2012-0224. Per: http://cwe.mitre.org/data/definitions/426.html 'CWE-426: Untrusted Search Path' Per: http://www.us-cert.gov/control_systems/pdf/ICSA-12-025-02A.pdf 'This vulnerability may be exploitable from a remote machine.' http://www.us-cert.gov/control_systems/pdf/ICSA-12-025-02A.pdf Untrusted search path vulnerability in 7-Technologies (7T) AQUIS 1.5 and earlier allows local users to gain privileges via a Trojan horse DLL in the current working directory, a different vulnerability than CVE-2012-0223. Per: http://cwe.mitre.org/data/definitions/426.html 'CWE-426: Untrusted Search Path' Per: http://www.us-cert.gov/control_systems/pdf/ICSA-12-025-02.pdf 'This vulnerability may be exploitable from a remote machine' http://www.us-cert.gov/control_systems/pdf/ICSA-12-025-01.pdf Cross-site scripting (XSS) vulnerability in Invensys Wonderware Information Server 4.0 SP1 and 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. 52851 1026886 1026887 http://www.us-cert.gov/control_systems/pdf/ICSA-12-062-01.pdf wis-unspecified-xss(74549) SQL injection vulnerability in Invensys Wonderware Information Server 4.0 SP1 and 4.5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. 80889 52851 1026886 1026887 http://www.us-cert.gov/control_systems/pdf/ICSA-12-062-01.pdf wis-unspecified-sql-injection(74550) Buffer overflow in the VSFlex7.VSFlexGrid ActiveX control in ComponentOne FlexGrid 7.1, as used in Open Automation Software OPC Systems.NET, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long archive file name argument to the Archive method. Per: http://www.us-cert.gov/control_systems/pdf/ICSA-12-012-01A.pdf 'AFFECTED PRODUCTS All versions of OPC Sytems.NET prior to Version 5.0 are affected.' http://dsecrg.com/pages/vul/show.php?id=406 51601 http://www.us-cert.gov/control_systems/pdf/ICSA-12-012-01A.pdf flexgrid-activex-bo(72604) Invensys Wonderware Information Server 4.0 SP1 and 4.5 does not properly implement client controls, which allows remote attackers to bypass intended access restrictions via unspecified vectors. 80890 52851 1026886 1026887 http://www.us-cert.gov/control_systems/pdf/ICSA-12-062-01.pdf The Data Archiver service in GE Intelligent Platforms Proficy Historian 4.5 and earlier allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted session on TCP port 14000 to (1) ihDataArchiver.exe or (2) ihDataArchiver_x64.exe. 48369 http://support.ge-ip.com/support/index?page=kbchannel&id=S:KB14767 52437 http://www.us-cert.gov/control_systems/pdf/ICSA-12-032-01.pdf PRRDS.exe in the Proficy Remote Data Service in GE Intelligent Platforms Proficy Plant Applications 5.0 and earlier allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted TCP session on port 12299. 48415 http://support.ge-ip.com/support/index?page=kbchannel&id=S:KB14766 52434 http://www.us-cert.gov/control_systems/pdf/ICSA-12-032-02.pdf proficy-plant-prrds-code-exec(73956) PRLicenseMgr.exe in the Proficy Server License Manager in GE Intelligent Platforms Proficy Plant Applications 5.0 and earlier allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted TCP session on port 12401. 48415 http://support.ge-ip.com/support/index?page=kbchannel&id=S:KB14766 52434 http://www.us-cert.gov/control_systems/pdf/ICSA-12-032-02.pdf proficy-prlicensemgr-code-exec(73957) Directory traversal vulnerability in rifsrvd.exe in the Remote Interface Service in GE Intelligent Platforms Proficy Real-Time Information Portal 2.6, 3.0, 3.0 SP1, and 3.5 allows remote attackers to modify the configuration via crafted strings. http://support.ge-ip.com/support/index?page=kbchannel&id=S:KB14768 52439 http://www.us-cert.gov/control_systems/pdf/ICSA-12-032-03.pdf Cross-site scripting (XSS) vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to inject arbitrary web script or HTML via a malformed URL. 52051 http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf SQL injection vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary SQL commands via a malformed URL. 52051 http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf Cross-site request forgery (CSRF) vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. 52051 http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf Advantech/BroadWin WebAccess 7.0 and earlier allows remote attackers to obtain sensitive information via a direct request to a URL. NOTE: the vendor reportedly "does not consider it to be a security risk." 52051 http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf Advantech/BroadWin WebAccess before 7.0 allows remote attackers to (1) enable date and time syncing or (2) disable date and time syncing via a crafted URL. 52051 http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf Stack-based buffer overflow in opcImg.asp in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via unspecified vectors. 52051 http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf uaddUpAdmin.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to modify an administrative password via a password-change request. 52051 http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf GbScriptAddUp.asp in Advantech/BroadWin WebAccess before 7.0 does not properly perform authentication, which allows remote attackers to execute arbitrary code via unspecified vectors. 52051 http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf Advantech/BroadWin WebAccess before 7.0 allows remote attackers to cause a denial of service (memory corruption) via a modified stream identifier to a function. 52051 http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf webaccess-stream-code-execution(73281) Format string vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via format string specifiers in a message string. 52051 http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf Buffer overflow in an ActiveX control in bwocxrun.ocx in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code by leveraging the ability to write arbitrary content to any pathname. 52051 http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf Multiple SQL injection vulnerabilities in Advantech/BroadWin WebAccess before 7.0 allow remote attackers to execute arbitrary SQL commands via crafted string input. 52051 http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf Multiple stack-based buffer overflows in RobNetScanHost.exe in ABB Robot Communications Runtime before 5.14.02, as used in ABB Interlink Module, IRC5 OPC Server, PC SDK, PickMaster 3 and 5, RobView 5, RobotStudio, WebWare SDK, and WebWare Server, allow remote attackers to execute arbitrary code via a crafted (1) 0xA or (2) 0xE Netscan packet. 20120222 ZDI-12-033 : ABB WebWare RobNetScanHost.exe Remote Code Execution Vulnerability 52123 http://www.us-cert.gov/control_systems/pdf/ICSA-12-059-01.pdf http://www.zerodayinitiative.com/advisories/ZDI-12-033/ http://www05.abb.com/global/scot/scot348.nsf/veritydisplay/f261be074480dc24c12579a00049ecd5/$file/si10227a1%20vulnerability%20security%20advisory.pdf Directory traversal vulnerability in an unspecified ActiveX control in Ecava IntegraXor before 3.71.4200 allows remote attackers to execute arbitrary code via vectors involving an HTML document on the server. 48558 http://www.us-cert.gov/control_systems/pdf/ICSA-12-083-01.pdf integraxor-activex-directory-traversal(74388) ImageMagick 6.7.5-7 and earlier allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted offset and count values in the ResolutionUnit tag in the EXIF IFD0 of an image. RHSA-2012:0544 RHSA-2012:0545 USN-1435-1 http://www.cert.fi/en/reports/2012/vulnerability595210.html DSA-2427 GLSA-201203-09 http://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=20286 1027032 ImageMagick 6.7.5-7 and earlier allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted image whose IFD contains IOP tags that all reference the beginning of the IDF. RHSA-2012:0544 RHSA-2012:0545 USN-1435-1 http://www.cert.fi/en/reports/2012/vulnerability595210.html DSA-2427 GLSA-201203-09 http://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=20286 51957 1027032 Buffer overflow in the ospf_ls_upd_list_lsa function in ospf_packet.c in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a Link State Update (aka LS Update) packet that is smaller than the length specified in its header. FEDORA-2012-5352 FEDORA-2012-5411 FEDORA-2012-5436 RHSA-2012:1258 RHSA-2012:1259 DSA-2459 VU#551715 https://bugzilla.quagga.net/show_bug.cgi?id=705 Buffer overflow in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (daemon crash) via a Link State Update (aka LS Update) packet containing a network-LSA link-state advertisement for which the data-structure length is smaller than the value in the Length header field. FEDORA-2012-5352 FEDORA-2012-5411 FEDORA-2012-5436 RHSA-2012:1258 RHSA-2012:1259 DSA-2459 VU#551715 Multiple cross-site scripting (XSS) vulnerabilities in Demand Media Pluck SiteLife before 5.0.13 allow remote attackers to inject arbitrary web script or HTML via (1) the jsonRequest parameter to Direct/Process, the (2) r or (3) cb parameter to Direct/jsonp.htm, or (4) the cb parameter to sys/jsonp.app/.htm. VU#400619 http://www.kb.cert.org/vuls/id/MAPG-8Q6JEG 52968 plucksitelife-multiple-xss(74805) Stack-based buffer overflow in the HMIWeb Browser HSCDSPRenderDLL ActiveX control in Honeywell Process Solutions (HPS) Experion R2xx, R30x, R31x, and R400.x; Honeywell Building Solutions (HBS) Enterprise Building Manager R400 and R410.1; and Honeywell Environmental Combustion and Controls (ECC) SymmetrE R410.1 allows remote attackers to execute arbitrary code via unspecified vectors. http://www.us-cert.gov/control_systems/pdf/ICSA-12-150-01.pdf https://www.honeywellprocess.com/en-US/support/pages/all-notifications.aspx The BGP implementation in bgpd in Quagga before 0.99.20.1 does not properly use message buffers for OPEN messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a message associated with a malformed Four-octet AS Number Capability (aka AS4 capability). FEDORA-2012-5352 FEDORA-2012-5411 FEDORA-2012-5436 RHSA-2012:1259 DSA-2459 VU#551715 Apache Traffic Server 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3 does not properly allocate heap memory, which allows remote attackers to cause a denial of service (daemon crash) via a long HTTP Host header. 20120322 [ANNOUNCE] Apache Traffic Server releases for security incident CVE-2012-0256 20120322 [ANNOUNCE] Apache Traffic Server releases for security incident CVE-2012-0256 http://trafficserver.apache.org/downloads 52696 1026847 https://www.cert.fi/en/reports/2012/vulnerability612884.html Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware Application Server 2012 and earlier, Foxboro Control Software 3.1 and earlier, InFusion CE/FE/SCADA 2.5 and earlier, Wonderware Information Server 4.5 and earlier, ArchestrA Application Object Toolkit 3.2 and earlier, and InTouch 10.0 through 10.5 might allow remote attackers to execute arbitrary code via a long string to the Open member, leading to a function-pointer overwrite. http://www.us-cert.gov/control_systems/pdf/ICSA-12-081-01.pdf https://wdnresource.wonderware.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000071.pdf Heap-based buffer overflow in the WWCabFile ActiveX component in the Wonderware System Platform in Invensys Wonderware Application Server 2012 and earlier, Foxboro Control Software 3.1 and earlier, InFusion CE/FE/SCADA 2.5 and earlier, Wonderware Information Server 4.5 and earlier, ArchestrA Application Object Toolkit 3.2 and earlier, and InTouch 10.0 through 10.5 might allow remote attackers to execute arbitrary code via a long string to the AddFile member. http://www.us-cert.gov/control_systems/pdf/ICSA-12-081-01.pdf https://wdnresource.wonderware.com/support/docs/_SecurityBulletins/Security_Bulletin_LFSEC00000071.pdf The GetEXIFProperty function in magick/property.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (crash) via a zero value in the component count of an EXIF XResolution tag in a JPEG file, which triggers an out-of-bounds read. openSUSE-SU-2012:0692 RHSA-2012:0544 USN-1435-1 http://www.cert.fi/en/reports/2012/vulnerability635606.html DSA-2462 http://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=20629 52898 1027032 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-0259 imagemagick-jpegexif-dos(74657) The JPEGWarningHandler function in coders/jpeg.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (memory consumption) via a JPEG image with a crafted sequence of restart markers. openSUSE-SU-2012:0692 RHSA-2012:0544 RHSA-2012:0545 http://www.cert.fi/en/reports/2012/vulnerability635606.html DSA-2462 http://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=20629 52898 1027032 USN-2132-1 imagemagick-jpegwarninghandler-dos(74658) license.php in system-portal before 1.6.2 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the timestamp parameter for an install action. 20120102 OP5 Monitor - Multiple Vulnerabilities http://www.ekelow.se/file_uploads/Advisories/ekelow-aid-2012-01.pdf http://www.op5.com/news/support-news/fixed-vulnerabilities-op5-monitor-op5-appliance/ https://bugs.op5.com/view.php?id=5094 op5config/welcome in system-op5config before 2.0.3 in op5 Monitor and op5 Appliance before 5.5.3 allows remote attackers to execute arbitrary commands via shell metacharacters in the password parameter. 20120102 OP5 Monitor - Multiple Vulnerabilities http://www.ekelow.se/file_uploads/Advisories/ekelow-aid-2012-01.pdf http://www.op5.com/news/support-news/fixed-vulnerabilities-op5-monitor-op5-appliance/ https://bugs.op5.com/view.php?id=5094 monitor/index.php in op5 Monitor and op5 Appliance before 5.5.1 allows remote authenticated users to obtain sensitive information such as database and user credentials via error messages that are triggered by (1) a malformed hoststatustypes parameter to status/service/all or (2) a crafted request to config. 20120102 OP5 Monitor - Multiple Vulnerabilities http://www.ekelow.se/file_uploads/Advisories/ekelow-aid-2012-01.pdf http://www.op5.com/news/support-news/fixed-vulnerabilities-op5-monitor-op5-appliance/ https://bugs.op5.com/view.php?id=5094 op5 Monitor and op5 Appliance before 5.5.0 do not properly manage session cookies, which allows remote attackers to have an unspecified impact via unspecified vectors. 20120102 OP5 Monitor - Multiple Vulnerabilities http://www.ekelow.se/file_uploads/Advisories/ekelow-aid-2012-01.pdf http://www.op5.com/news/support-news/fixed-vulnerabilities-op5-monitor-op5-appliance/ https://bugs.op5.com/view.php?id=5094 Stack-based buffer overflow in Apple QuickTime before 7.7.2 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted pathname for a file. APPLE-SA-2012-05-15-1 http://support.apple.com/kb/HT5261 53578 1027065 oval:org.mitre.oval:def:16170 Multiple stack-based buffer overflows in the NTR ActiveX control before 2.0.4.8 allow remote attackers to execute arbitrary code via (1) a long bstrUrl parameter to the StartModule method, (2) a long bstrParams parameter to the Check method, a long bstrUrl parameter to the (3) Download or (4) DownloadModule method during construction of a .ntr pathname, or a long bstrUrl parameter to the (5) Download or (6) DownloadModule method during construction of a URL. 20120111 Secunia Research: NTR ActiveX Control Four Buffer Overflow Vulnerabilities 21841 ntr-startmodule-bo(72291) ntr-check-bo(72292) ntr-download-bo(72293) The StopModule method in the NTR ActiveX control before 2.0.4.8 allows remote attackers to execute arbitrary code via a crafted lModule parameter that triggers use of an arbitrary memory address as a function pointer. 21839 ntr-stopmodule-code-exec(72295) Integer overflow in the CYImage::LoadJPG method in YImage.dll in Yahoo! Messenger before 11.5.0.155, when photo sharing is enabled, might allow remote attackers to execute arbitrary code via a crafted JPG image that triggers a heap-based buffer overflow. Buffer overflow in JustSystems Ichitaro 2011 Sou, Ichitaro 2006 through 2011, Ichitaro Government 2006 through 2010, Ichitaro Portable with oreplug, Ichitaro Viewer, JUST School, JUST School 2009 and 2010, JUST Jump 4, JUST Frontier, oreplug, Shuriken Pro4, Shuriken 2007 through 2010, Shuriken Pro4 Corporate Edition, Shuriken CE/2007 through CE/2009 Corporate Edition, Shuriken 2010 Corporate Edition, Rekishimail Sengokubusho no missho, and Bakumatsushishi no missho allows remote attackers to execute arbitrary code via a crafted image file. JVN#09619876 JVNDB-2012-000035 http://www.justsystems.com/jp/info/js12001.html Multiple stack-based buffer overflows in Csound before 5.16.6 allow remote attackers to execute arbitrary code via a crafted (1) hetro file to the getnum function in util/heti_main.c or (2) PVOC file to the getnum function in util/pv_import.c. openSUSE-SU-2012:0315 openSUSE-SU-2012:0370 http://sourceforge.net/projects/csound/files/csound5/csound5.16/Version5.16_Notes/view Integer overflow in the WebConsole component in gwia.exe in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before 8.0.3 HP1 and 2012 before SP1 might allow remote attackers to execute arbitrary code via a crafted request that triggers a heap-based buffer overflow, as demonstrated by a request with -1 in the Content-Length HTTP header. Per: http://www.novell.com/support/kb/doc.php?id=7010769 "Previous versions of GroupWise are likely also vulnerable but are no longer supported." http://www.novell.com/support/kb/doc.php?id=7010769 http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=61&Itemid=61 https://bugzilla.novell.com/show_bug.cgi?id=746199 Cross-site scripting (XSS) vulnerability in the WebAccess component in Novell GroupWise 8.0 before Support Pack 3 allows remote attackers to inject arbitrary web script or HTML via the merge parameter. http://www.novell.com/support/kb/doc.php?id=7010368 1027615 https://bugzilla.novell.com/show_bug.cgi?id=702785 https://bugzilla.novell.com/show_bug.cgi?id=740563 Multiple stack-based buffer overflows in MinaliC 2.0.0 allow remote attackers to execute arbitrary code via a (1) session_id cookie in a request to the get_cookie_value function in response.c, (2) directory name in a request to the add_default_file function in response.c, or (3) file name in a request to the retrieve_physical_file_name_or_brows function in response.c. 52873 minalic-getcookievalue-bo(74651) minalic-adddefaultfile-bo(74652) minalic-response-bo(74653) Heap-based buffer overflow in Photoshop.exe in Adobe Photoshop CS5 12.x before 12.0.5, CS5.1 12.1.x before 12.1.1, and CS6 13.x before 13.0.1 allows remote attackers to execute arbitrary code via a crafted TIFF image with SGI24LogLum compression. http://www.adobe.com/support/security/bulletins/apsb12-11.html http://www.adobe.com/support/security/bulletins/apsb12-20.html 55372 1027477 adobe-photoshop-unspec-bo(78185) Multiple heap-based buffer overflows in XnView before 1.99 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a (1) SGI32LogLum compressed TIFF image or (2) SGI32LogLum compressed TIFF image with the PhotometricInterpretation encoding set to LogL. http://newsgroup.xnview.com/viewtopic.php?f=35&t=25858 19337 19338 http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=48 http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=49 Heap-based buffer overflow in XnView before 1.99 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted PCT image. http://newsgroup.xnview.com/viewtopic.php?f=35&t=25858 19336 http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=50 Heap-based buffer overflow in the FlashPix PlugIn before 4.3.4.0 for IrfanView might allow remote attackers to execute arbitrary code via a .fpx file containing a crafted FlashPix image that is not properly handled during decompression. http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=41&Itemid=41 53009 Quest Toad for Data Analysts 3.0.1 uses weak permissions (Everyone: Full Control) for the %COMMONPROGRAMFILES%\Quest Shared directory, which allows local users to gain privileges via a Trojan horse file. 53276 quest-toad-insecure-permissions(75192) Heap-based buffer overflow in XnView before 1.99 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted ImageLeftPosition value in an ImageDescriptor structure in a GIF image. http://newsgroup.xnview.com/viewtopic.php?f=35&t=25858 19335 http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=51 Cross-site scripting (XSS) vulnerability in the tpl_mediaFileList function in inc/template.php in DokuWiki before 2012-01-25b allows remote attackers to inject arbitrary web script or HTML via the ns parameter in a medialist action to lib/exe/ajax.php. http://bugs.dokuwiki.org/index.php?do=details&task_id=2561 FEDORA-2012-16550 FEDORA-2012-16614 FEDORA-2012-16605 GLSA-201301-07 54439 Stack-based buffer overflow in the SetSource method in the Cisco Linksys PlayerPT ActiveX control 1.0.0.15 in PlayerPT.ocx on the Cisco WVC200 Wireless-G PTZ Internet video camera allows remote attackers to execute arbitrary code via a long URL in the first argument (aka the sURL argument). 20120717 Secunia Research: Cisco Linksys PlayerPT ActiveX Control "SetSource()" Buffer Overflow 54588 1027259 cisco-linksys-activex-bo(77085) Multiple cross-site scripting (XSS) vulnerabilities in Stoneware webNetwork before 6.0.8.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://infosec42.blogspot.com/2012/01/cve-2012-0285-and-cve-2012-0286.html http://www.stone-ware.com/support/techdocs/kb/d1960/sb_6_0_8.pdf http://www.stone-ware.com/swql.jsp?kb=d1960 Cross-site request forgery (CSRF) vulnerability in Stoneware webNetwork before 6.0.8.0 allows remote attackers to hijack the authentication of unspecified victims for requests that modify user accounts. http://infosec42.blogspot.com/2012/01/cve-2012-0285-and-cve-2012-0286.html http://www.stone-ware.com/support/techdocs/kb/d1960/sb_6_0_8.pdf http://www.stone-ware.com/swql.jsp?kb=d1960 Cross-site scripting (XSS) vulnerability in wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via the query string in a POST operation that is not properly handled by the "Duplicate comment detected" feature. http://oldmanlab.blogspot.com/2012/01/wordpress-33-xss-vulnerability.html 51237 1026542 https://wordpress.org/news/2012/01/wordpress-3-3-1/ Buffer overflow in Symantec Endpoint Protection (SEP) 11.0.600x through 11.0.710x and Symantec Network Access Control (SNAC) 11.0.600x through 11.0.710x allows local users to gain privileges, and modify data or cause a denial of service, via a crafted script. 51795 1027093 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120522_01 Symantec pcAnywhere through 12.5.3, Altiris IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), Altiris Client Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), and Altiris Deployment Solution Remote pcAnywhere Solution 7.1 (aka 12.5.x and 12.6.x) do not properly handle the client state after abnormal termination of a remote session, which allows remote attackers to obtain access to the client by leveraging an "open client session." 48092 51862 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120124_00 pcanywhere-unauth-access(72996) Symantec pcAnywhere through 12.5.3, Altiris IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), Altiris Client Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), and Altiris Deployment Solution Remote pcAnywhere Solution 7.1 (aka 12.5.x and 12.6.x) allow remote attackers to cause a denial of service (application crash or hang) via (1) malformed data from a client, (2) malformed data from a server, or (3) an invalid response. 48092 51965 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120124_00 The awhost32 service in Symantec pcAnywhere through 12.5.3, Altiris IT Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), Altiris Client Management Suite pcAnywhere Solution 7.0 (aka 12.5.x) and 7.1 (aka 12.6.x), and Altiris Deployment Solution Remote pcAnywhere Solution 7.1 (aka 12.5.x and 12.6.x) allows remote attackers to cause a denial of service (daemon crash) via a crafted TCP session on port 5631. 48092 18493 52094 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120301_00 Multiple SQL injection vulnerabilities in Symantec Altiris WISE Package Studio before 8.0MR1 allow remote attackers to execute arbitrary SQL commands via unspecified vectors. 80201 52392 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120314_00 Directory traversal vulnerability in the Manager service in the management console in Symantec Endpoint Protection (SEP) 12.1 before 12.1 RU1-MP1 allows remote attackers to delete files via unspecified vectors. 53182 1027093 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120522_01 The Manager service in the management console in Symantec Endpoint Protection (SEP) 12.1 before 12.1 RU1-MP1 allows remote attackers to conduct file-insertion attacks and execute arbitrary code by leveraging exploitation of CVE-2012-0294. 53183 53184 1027093 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120522_01 Multiple cross-site scripting (XSS) vulnerabilities in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. 53396 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120517_00 The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts, which allows remote attackers to execute arbitrary code by (1) injecting crafted data or (2) including crafted data. 53444 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120517_00 symantec-web-file-include(75731) The file-management scripts in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to (1) read or (2) delete arbitrary files via unspecified vectors. 53442 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120517_00 symantec-web-file-download(75732) The file-management scripts in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to upload arbitrary code to a designated pathname, and possibly execute this code, via unspecified vectors. 53443 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120517_00 symantec-web-unspec-command-exec(75730) Brightmail Control Center in Symantec Message Filter 6.3 does not properly restrict establishment of sessions to the listening port, which allows remote attackers to obtain potentially sensitive version information via unspecified vectors. 54136 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120626_00 Session fixation vulnerability in Brightmail Control Center in Symantec Message Filter 6.3 allows remote attackers to hijack web sessions via unspecified vectors. 54135 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120626_00 Cross-site scripting (XSS) vulnerability in Brightmail Control Center in Symantec Message Filter 6.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. 54134 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120626_00 Multiple cross-site request forgery (CSRF) vulnerabilities in Brightmail Control Center in Symantec Message Filter 6.3 allow remote attackers to hijack the authentication of arbitrary users for requests that (1) execute application commands or (2) create admin accounts. 54133 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120626_00 Symantec LiveUpdate Administrator before 2.3.1 uses weak permissions (Everyone: Full Control) for the installation directory, which allows local users to gain privileges via a Trojan horse file. http://www.nessus.org/plugins/index.php?view=single&id=59193 53903 1027182 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120615_00 Untrusted search path vulnerability in Symantec System Recovery 2011 before SP2 and Backup Exec System Recovery 2010 before SP5 allows local users to gain privileges via a Trojan horse DLL in the current working directory. Per: http://cwe.mitre.org/data/definitions/426.html 'CWE-426: Untrusted Search Path' 54594 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120720_01 Symantec Ghost Solution Suite 2.x through 2.5.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted backup file. 55748 1027648 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20121010_00 Multiple cross-site scripting (XSS) vulnerabilities in Symantec Messaging Gateway (SMG) before 10.0 allow remote attackers to inject arbitrary web script or HTML via (1) web content or (2) e-mail content. 55138 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120827_00 symantec-gateway-unspec-xss(78031) Cross-site request forgery (CSRF) vulnerability in Symantec Messaging Gateway (SMG) before 10.0 allows remote attackers to hijack the authentication of administrators. 55137 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120827_00 Cross-site scripting (XSS) vulnerability in Cogent DataHub 7.1.2 and earlier, Cascade DataHub 6.4.20 and earlier, and OPC DataHub 6.4.20 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. JVN#12983784 JVNDB-2012-000001 http://www.cogentdatahub.com/ReleaseNotes.html 51375 http://www.us-cert.gov/control_systems/pdf/ICSA-12-016-01.pdf cogentdatahub-unspecified-xss(72305) CRLF injection vulnerability in Cogent DataHub 7.1.2 and earlier, Cascade DataHub 6.4.20 and earlier, and OPC DataHub 6.4.20 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. JVN#63249231 JVNDB-2012-000002 http://www.cogentdatahub.com/ReleaseNotes.html 51375 http://www.us-cert.gov/control_systems/pdf/ICSA-12-016-01.pdf cogentdatahub-unspecified-header-injection(72306) Cross-site scripting (XSS) vulnerability in osCommerce 2.2MS1J before R9 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. JVN#36559450 JVNDB-2012-000004 http://sourceforge.jp/forum/forum.php?forum_id=28119 Cross-site scripting (XSS) vulnerability in osCommerce 2.2MS1J before R9, and osCommerce Online Merchant before 2.3.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. JVN#64386898 JVNDB-2012-000005 http://sourceforge.jp/forum/forum.php?forum_id=28119 Cross-site scripting (XSS) vulnerability in glucose 2 before stage 6.2 allows remote attackers to inject arbitrary web script or HTML via an RSS feed. http://glucose.jp/release/19 JVN#65869891 JVNDB-2012-000008 Multiple cross-site request forgery (CSRF) vulnerabilities on the eAccess Pocket WiFi (aka GP02) router before 2.00 with firmware 11.203.11.05.168 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) initialize settings or (2) reboot the device. http://emobile.jp/topics/info20120201_01.html JVN#33021167 JVNDB-2012-000010 51782 Untrusted search path vulnerability in ALFTP before 5.31 allows local users to gain privileges via a Trojan horse executable file in a directory that is accessed for reading an extensionless file, as demonstrated by executing the README.exe file when a user attempts to access the README file. Per: http://cwe.mitre.org/data/definitions/426.html 'CWE-426: Untrusted Search Path' http://jvn.jp/en/jp/JVN85695061/995223/index.html JVN#85695061 JVNDB-2012-000011 http://www.altools.jp/download.aspx http://www.altools.jp/ETC/NEWS.aspx?mid=231&vidx=118 The Cookpad 1.5.16 and earlier and Cookpad Noseru 1.1.1 and earlier applications for Android do not properly implement the WebView class, which allows remote attackers to obtain sensitive information via a crafted application. http://cookpad.typepad.jp/help/2012/02/23oshirase.html JVN#25731073 JVNDB-2012-000014 48065 52189 Multiple cross-site request forgery (CSRF) vulnerabilities in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allow remote attackers to hijack the authentication of arbitrary users for requests that modify data via the (1) commenting feature or (2) community script. JVN#70683217 JVNDB-2012-000015 DSA-2423 http://www.movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.html http://www.movabletype.org/documentation/appendices/release-notes/513.html 52138 1026738 Multiple cross-site scripting (XSS) vulnerabilities in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allow remote attackers to inject arbitrary web script or HTML via vectors involving templates, a different issue than CVE-2012-1262. JVN#49836527 JVNDB-2012-000016 DSA-2423 http://www.movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.html http://www.movabletype.org/documentation/appendices/release-notes/513.html 52138 1026738 The file-management system in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allows remote authenticated users to execute arbitrary commands by leveraging the file-upload feature, related to an "OS Command Injection" issue. JVN#92683325 JVNDB-2012-000017 DSA-2423 http://www.movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.html http://www.movabletype.org/documentation/appendices/release-notes/513.html 52138 1026738 Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allows remote attackers to take control of sessions via unspecified vectors related to the (1) commenting feature and (2) community script. JVN#20083397 JVNDB-2012-000018 DSA-2423 http://www.movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.html http://www.movabletype.org/documentation/appendices/release-notes/513.html 52138 1026738 Unspecified vulnerability in the device driver in Kingsoft Internet Security 2011 allows local users to cause a denial of service via a crafted application. JVN#31517714 JVNDB-2012-000019 http://www.kingsoft.jp/support/security/support_news/supportnews_20120229 The EStrongs ES File Explorer application 1.6.0.2 through 1.6.1.1 for Android does not properly restrict access, which allows remote attackers to read arbitrary files via vectors involving an unspecified function. JVN#08871006 JVNDB-2012-000020 Cross-site scripting (XSS) vulnerability in the Autocomplete plugin before 3.0 for SquirrelMail allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. JVN#56653852 JVNDB-2012-000021 http://squirrelmail.org/plugin_view.php?id=32 Cross-site scripting (XSS) vulnerability in Jenkins before 1.454, Jenkins LTS before 1.424.5, and Jenkins Enterprise 1.400.x before 1.400.0.13 and 1.424.x before 1.424.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0325. JVN#14791558 JVNDB-2012-000022 http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-03-05.cb 52384 Cross-site scripting (XSS) vulnerability in Jenkins before 1.454, Jenkins LTS before 1.424.5, and Jenkins Enterprise 1.400.x before 1.400.0.13 and 1.424.x before 1.424.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0324. JVN#79950061 JVNDB-2012-000023 http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2012-03-05.cb 52384 The twicca application 0.7.0 through 0.9.30 for Android does not properly restrict the use of network privileges, which allows remote attackers to read media files on an SD card via a crafted application. JVN#31860555 JVNDB-2012-000024 80106 http://twicca.r246.jp/notice/ 52442 twicca-android-sec-bypass(73951) https://play.google.com/store/apps/details?id=jp.r246.twicca Cross-site scripting (XSS) vulnerability in Redmine before 1.3.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. JVN#93406632 JVNDB-2012-000025 http://www.redmine.org/versions/42 52447 Janetter before 3.3.0.0 (aka 3.3.0) allows remote attackers to obtain session information for twitter.com web sites via unspecified vectors. http://blog.janetter.net/ http://janetter.net/history.html JVN#10745573 JVNDB-2012-000026 52555 janetter-info-disclosure(74132) Cisco Digital Media Manager 5.2.2 and earlier, and 5.2.3, allows remote authenticated users to execute arbitrary code via vectors involving a URL and an administrative resource, aka Bug ID CSCts63878. 20120118 Cisco Digital Media Manager Privilege Escalation Vulnerability 1026541 Cisco TelePresence Video Communication Server with software before X7.0.1 allows remote attackers to cause a denial of service (device crash) via a malformed SIP message, aka Bug ID CSCtr20426. Per: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120229-vcs 'Vulnerable Products These vulnerabilities affect all three variants (Control, Expressway, and Starter Pack Express) of Cisco TelePresence Video Communication Server.' 20120229 Cisco TelePresence Video Communication Server Session Initiation Protocol Denial of Service Vulnerabilities Cisco TelePresence Video Communication Server with software before X7.0.1 allows remote attackers to cause a denial of service (device crash) via a crafted SIP packet, as demonstrated by a SIP INVITE message from a Tandberg device, aka Bug ID CSCtq73319. Per: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120229-vcs 'Vulnerable Products These vulnerabilities affect all three variants (Control, Expressway, and Starter Pack Express) of Cisco TelePresence Video Communication Server.' 20120229 Cisco TelePresence Video Communication Server Session Initiation Protocol Denial of Service Vulnerabilities Cisco Small Business IP phones with SPA 500 series firmware 7.4.9 and earlier do not require authentication for Push XML requests, which allows remote attackers to make telephone calls via an XML document, aka Bug ID CSCts08768. 1027012 http://www-europe.cisco.com/en/US/docs/voice_ip_comm/csbpipp/ip_phones/release/notes/spa525g_relnote_7_5_1.pdf Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 7.2 through 8.4 do not properly perform proxy authentication during attempts to cut through a firewall, which allows remote attackers to obtain sensitive information via a connection attempt, aka Bug ID CSCtx42746. http://www.cisco.com/web/software/280775065/89203/ASA-843-Interim-Release-Notes.html 53558 1027008 SQL injection vulnerability in the web component in Cisco Unified MeetingPlace 7.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCtx08939. http://www.cisco.com/en/US/docs/voice_ip_comm/meetingplace/7_1/english/release_notes/mp71rn.html Cisco IOS 12.2 through 12.4 and 15.0 does not recognize the vrf-also keyword during enforcement of access-class commands, which allows remote attackers to establish SSH connections from arbitrary source IP addresses via a standard SSH client, aka Bug ID CSCsv86113. http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/release/notes/caveats_SXH_rebuilds.html 1027005 https://supportforums.cisco.com/thread/2030226 Cisco IOS 12.2 through 12.4 and 15.0 does not recognize the vrf-also keyword during enforcement of access-class commands, which allows remote attackers to establish TELNET connections from arbitrary source IP addresses via a standard TELNET client, aka Bug ID CSCsi77774. http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/release/notes/caveats_SXF_rebuilds.html 1027005 Cross-site scripting (XSS) vulnerability in the management interface on the Cisco IronPort Encryption Appliance with software before 6.5.3 allows remote attackers to inject arbitrary web script or HTML via the header parameter to the default URI under admin/, aka bug ID 72410. Additional information can be found at: http://www.secureworks.com/research/advisories/SWRX-2012-001/ http://tools.cisco.com/security/center/viewAlert.x?alertId=25045 http://www.secureworks.com/research/advisories/SWRX-2012-001/ Cisco NX-OS 4.2.x before 4.2(1)SV1(5.1) on Nexus 1000v series switches; 4.x and 5.0.x before 5.0(2)N1(1) on Nexus 5000 series switches; and 4.2.x before 4.2.8, 5.0.x before 5.0.5, and 5.1.x before 5.1.1 on Nexus 7000 series switches allows remote attackers to cause a denial of service (netstack process crash and device reload) via a malformed IP packet, aka Bug IDs CSCti23447, CSCti49507, and CSCtj01991. 20120215 Cisco NX-OS Malformed IP Packet Denial of Service Vulnerability The UDP inspection engine on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.0 before 8.0(5.25), 8.1 before 8.1(2.50), 8.2 before 8.2(5.5), 8.3 before 8.3(2.22), 8.4 before 8.4(2.1), and 8.5 before 8.5(1.2) does not properly handle flows, which allows remote attackers to cause a denial of service (device reload) via a crafted series of (1) IPv4 or (2) IPv6 UDP packets, aka Bug ID CSCtq10441. 20120314 Multiple Vulnerabilities in Cisco ASA 5500 Series Adaptive Security Appliances and Cisco Catalyst 6500 Series ASA Services Module 52484 1026800 cisco-udp-dos(74029) The Threat Detection feature on Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.0 through 8.2 before 8.2(5.20), 8.3 before 8.3(2.29), 8.4 before 8.4(3), 8.5 before 8.5(1.6), and 8.6 before 8.6(1.1) allows remote attackers to cause a denial of service (device reload) via (1) IPv4 or (2) IPv6 packets that trigger a shun event, aka Bug ID CSCtw35765. 80044 20120314 Multiple Vulnerabilities in Cisco ASA 5500 Series Adaptive Security Appliances and Cisco Catalyst 6500 Series ASA Services Module 52489 1026800 ciscoasa-threat-dos(74030) Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 8.4 before 8.4(2.11) and 8.5 before 8.5(1.4) allow remote attackers to cause a denial of service (device reload) via (1) IPv4 or (2) IPv6 packets that trigger syslog message 305006, aka Bug ID CSCts39634. 80045 20120314 Multiple Vulnerabilities in Cisco ASA 5500 Series Adaptive Security Appliances and Cisco Catalyst 6500 Series ASA Services Module 52488 1026800 Cisco Adaptive Security Appliances (ASA) 5500 series devices, and the ASA Services Module (ASASM) in Cisco Catalyst 6500 series devices, with software 7.0 through 7.2 before 7.2(5.7), 8.0 before 8.0(5.27), 8.1 before 8.1(2.53), 8.2 before 8.2(5.8), 8.3 before 8.3(2.25), 8.4 before 8.4(2.5), and 8.5 before 8.5(1.2) and the Firewall Services Module (FWSM) 3.1 and 3.2 before 3.2(23) and 4.0 and 4.1 before 4.1(8) in Cisco Catalyst 6500 series devices, when multicast routing is enabled, allow remote attackers to cause a denial of service (device reload) via a crafted IPv4 PIM message, aka Bug IDs CSCtr47517 and CSCtu97367. 80041 48421 20120314 Multiple Vulnerabilities in Cisco ASA 5500 Series Adaptive Security Appliances and Cisco Catalyst 6500 Series ASA Services Module 20120314 Cisco Firewall Services Module Crafted Protocol Independent Multicast Message Denial of Service Vulnerability 1026798 1026800 cisco-fwsm-pim-dos(74028) Buffer overflow in the Cisco Port Forwarder ActiveX control in cscopf.ocx, as distributed through the Clientless VPN feature on Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 7.0 through 7.2 before 7.2(5.6), 8.0 before 8.0(5.26), 8.1 before 8.1(2.53), 8.2 before 8.2(5.18), 8.3 before 8.3(2.28), 8.2 before 8.4(2.16), and 8.6 before 8.6(1.1), allows remote attackers to execute arbitrary code via unspecified vectors, aka Bug ID CSCtr00165. 20120314 Cisco ASA 5500 Series Adaptive Security Appliance Clientless VPN ActiveX Control Remote Code Execution Vulnerability VU#339177 1026799 cisco-asa-activex-bo(74027) The Cisco Cius with software before 9.2(1) SR2 allows remote attackers to cause a denial of service (device crash or hang) via malformed network traffic, aka Bug ID CSCto71445. Per: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120229-cius 'Vulnerable Products The following products are affected by the vulnerability detailed in this advisory: * Cius Wifi devices running Cius Software Version 9.2(1) SR1 and prior' http://archives.neohapsis.com/archives/bugtraq/2012-02/0186.html 20120229 Cisco Cius Denial of Service Vulnerability Memory leak in Cisco IOS before 15.1(1)SY, when IKEv2 debugging is enabled, allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCtn22376. http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.pdf The sccp-protocol component in Cisco IP Communicator (CIPC) 7.0 through 8.6 does not limit the rate of SCCP messages to Cisco Unified Communications Manager (CUCM), which allows remote attackers to cause a denial of service via vectors that trigger (1) on hook and (2) off hook messages, as demonstrated by a Plantronics headset, aka Bug ID CSCti40315. http://www.cisco.com/en/US/docs/voice_ip_comm/cipc/8_5/english/release_notes/CIPC8x_RN.html 1027013 The extended ACL functionality in Cisco IOS 12.2(58)SE2 and 15.0(1)SE discards all lines that end with a log or time keyword, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by sending network traffic, aka Bug ID CSCts01106. [cisco-nsp] 20120202 Ambiguous ACL "log" in 12.2(58)SE2? 1027005 The web interface on Cisco SRP 520 series devices with firmware before 1.1.26 and SRP 520W-U and 540 series devices with firmware before 1.2.4 allows remote authenticated users to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability," aka Bug ID CSCtt46871. 20120223 Cisco Small Business SRP 500 Series Multiple Vulnerabilities 1026736 Cisco SRP 520 series devices with firmware before 1.1.26 and SRP 520W-U and 540 series devices with firmware before 1.2.4 allow remote attackers to replace the configuration file via an upload request to an unspecified URL, aka Bug ID CSCtw55495. 20120223 Cisco Small Business SRP 500 Series Multiple Vulnerabilities 1026736 Directory traversal vulnerability in the Local TFTP file-upload application on Cisco SRP 520 series devices with firmware before 1.1.26 and SRP 520W-U and 540 series devices with firmware before 1.2.4 allows remote authenticated users to upload software to arbitrary directories via unspecified vectors, aka Bug ID CSCtw56009. 20120223 Cisco Small Business SRP 500 Series Multiple Vulnerabilities 1026736 Cisco Unity Connection before 7.1.3b(Su2) allows remote authenticated users to change the administrative password by leveraging the Help Desk Administrator role, aka Bug ID CSCtd45141. 20120229 Multiple Vulnerabilities in Cisco Unity Connection Cisco Unity Connection before 7.1.5b(Su5), 8.0 and 8.5 before 8.5.1(Su3), and 8.6 before 8.6.2 allows remote attackers to cause a denial of service (services crash) via a series of crafted TCP segments, aka Bug ID CSCtq67899. 20120229 Multiple Vulnerabilities in Cisco Unity Connection The administrative management interface on Cisco Wireless LAN Controller (WLC) devices with software 4.x, 5.x, 6.0, and 7.0 before 7.0.220.0, 7.1 before 7.1.91.0, and 7.2 before 7.2.103.0 allows remote attackers to cause a denial of service (device crash) via a malformed URL in an HTTP request, aka Bug ID CSCts81997. 20120229 Cisco Security Advisory: Multiple Vulnerabilities in Cisco Wireless LAN Controllers 20120229 Multiple Vulnerabilities in Cisco Wireless LAN Controllers Cisco Wireless LAN Controller (WLC) devices with software 6.0 and 7.0 before 7.0.220.0, 7.1 before 7.1.91.0, and 7.2 before 7.2.103.0 allow remote attackers to cause a denial of service (device reload) via a sequence of IPv6 packets, aka Bug ID CSCtt07949. 20120229 Cisco Security Advisory: Multiple Vulnerabilities in Cisco Wireless LAN Controllers 20120229 Multiple Vulnerabilities in Cisco Wireless LAN Controllers Cisco Wireless LAN Controller (WLC) devices with software 4.x, 5.x, 6.0, and 7.0 before 7.0.220.0 and 7.1 before 7.1.91.0, when WebAuth is enabled, allow remote attackers to cause a denial of service (device reload) via a sequence of (1) HTTP or (2) HTTPS packets, aka Bug ID CSCtt47435. 20120229 Cisco Security Advisory: Multiple Vulnerabilities in Cisco Wireless LAN Controllers 20120229 Multiple Vulnerabilities in Cisco Wireless LAN Controllers Cisco Wireless LAN Controller (WLC) devices with software 4.x, 5.x, 6.0, and 7.0 before 7.0.220.4, when CPU-based ACLs are enabled, allow remote attackers to read or modify the configuration via unspecified vectors, aka Bug ID CSCtu56709. 20120229 Cisco Security Advisory: Multiple Vulnerabilities in Cisco Wireless LAN Controllers 20120229 Multiple Vulnerabilities in Cisco Wireless LAN Controllers The voice-sipstack component in Cisco Unified Communications Manager (CUCM) 8.5 allows remote attackers to cause a denial of service (core dump) via vectors involving SIP messages that arrive after an upgrade, aka Bug ID CSCtj87367. http://www.cisco.com/en/US/docs/voice_ip_comm/cucmbe/rel_notes/8_5_1/cucmbe-rel_notes-851.html Cisco Adaptive Security Appliances (ASA) 5500 series devices with software 8.0 through 8.4 allow remote attackers to cause a denial of service (connection limit exceeded) by triggering a large number of stale connections that result in an incorrect value for an MPF connection count, aka Bug ID CSCtv19854. http://www.cisco.com/web/software/280775065/89203/ASA-843-Interim-Release-Notes.html The IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.2 and IOS XE 2.1.x through 2.6.x and 3.1.xS through 3.4.xS before 3.4.2S, 3.5.xS before 3.5.1S, and 3.2.xSG before 3.2.2SG allows remote attackers to cause a denial of service (device reload) by sending IKE UDP packets over (1) IPv4 or (2) IPv6, aka Bug ID CSCts38429. 20120328 Cisco IOS Internet Key Exchange Vulnerability 52757 1026863 ciscoios-ike-packet-dos(74427) The Multicast Source Discovery Protocol (MSDP) implementation in Cisco IOS 12.0, 12.2 through 12.4, and 15.0 through 15.2 and IOS XE 2.1.x through 2.6.x and 3.1.xS through 3.4.xS before 3.4.1S and 3.1.xSG and 3.2.xSG before 3.2.2SG allows remote attackers to cause a denial of service (device reload) via encapsulated IGMP data in an MSDP packet, aka Bug ID CSCtr28857. 20120328 Cisco IOS Software Multicast Source Discovery Protocol Vulnerability 52759 1026868 ciscoios-msdp-dos(74431) Memory leak in the NAT feature in Cisco IOS 12.4, 15.0, and 15.1 allows remote attackers to cause a denial of service (memory consumption, and device hang or reload) via SIP packets that require translation, related to a "memory starvation vulnerability," aka Bug ID CSCti35326. 20120328 Cisco IOS Software Network Address Translation Vulnerability 52758 1026864 ciscoios-nat-feature-dos(74432) Cisco IOS 12.2 through 12.4 and 15.0 through 15.2 and IOS XE 2.1.x through 2.6.x and 3.1.xS before 3.1.2S, 3.2.xS through 3.4.xS before 3.4.2S, 3.5.xS before 3.5.1S, and 3.1.xSG and 3.2.xSG before 3.2.2SG, when AAA authorization is enabled, allow remote authenticated users to bypass intended access restrictions and execute commands via a (1) HTTP or (2) HTTPS session, aka Bug ID CSCtr91106. 20120328 Cisco IOS Software Command Authorization Bypass 52755 1026860 The Smart Install feature in Cisco IOS 12.2, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (device reload) by sending a malformed Smart Install message over TCP, aka Bug ID CSCtt16051. 48610 20120328 Cisco IOS Software Smart Install Denial of Service Vulnerability 52756 1026867 ciscoios-smartinstall-dos(74430) The SSHv2 implementation in Cisco IOS 12.2, 12.4, 15.0, 15.1, and 15.2 and IOS XE 2.3.x through 2.6.x and 3.1.xS through 3.4.xS before 3.4.2S allows remote attackers to cause a denial of service (device reload) via a crafted username in a reverse SSH login attempt, aka Bug ID CSCtr49064. 48609 48641 20120328 Cisco IOS Software Reverse SSH Denial of Service Vulnerability 52752 1026866 ciscoios-sshv2-dos(74404) Memory leak in the HTTP Inspection Engine feature in the Zone-Based Firewall in Cisco IOS 12.4, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted transit HTTP traffic, aka Bug ID CSCtq36153. 48608 20120328 Cisco IOS Software Zone-Based Firewall Vulnerabilities 52753 1026861 ciscoios-inspectionengine-dos(74435) Memory leak in the H.323 inspection feature in the Zone-Based Firewall in Cisco IOS 12.4, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (memory consumption or device reload) via malformed transit H.323 traffic, aka Bug ID CSCtq45553. 48608 20120328 Cisco IOS Software Zone-Based Firewall Vulnerabilities 52753 1026861 ciscoios-h323messages-dos(74436) Cross-site scripting (XSS) vulnerability in ForgottenPassword.aspx in MailEnable Professional, Enterprise, and Premium 4.26 and earlier, 5.x before 5.53, and 6.x before 6.03 allows remote attackers to inject arbitrary web script or HTML via the Username parameter. 20120112 ME020567: MailEnable webmail cross-site scripting vulnerability CVE-2012-0389 18447 http://www.mailenable.com/kb/Content/Article.asp?ID=me020567 http://www.nerv.fi/CVE-2012-0389.txt 51401 1026519 mailenable-forgottenpassword-xss(72380) The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-handling code only if there is a specific relationship between a padding length and the ciphertext size, which makes it easier for remote attackers to recover partial plaintext via a timing side-channel attack, a related issue to CVE-2011-4108. SUSE-SU-2014:0320 http://www.isg.rhul.ac.uk/~kp/dtls.pdf The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter. 20120105 SEC Consult SA-20120104-0 :: Multiple critical vulnerabilities in Apache Struts2 http://struts.apache.org/2.x/docs/s2-008.html http://struts.apache.org/2.x/docs/version-notes-2311.html 18329 https://issues.apache.org/jira/browse/WW-3668 https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method. 20120105 SEC Consult SA-20120104-0 :: Multiple critical vulnerabilities in Apache Struts2 http://struts.apache.org/2.x/docs/s2-008.html http://struts.apache.org/2.x/docs/version-notes-2311.html 18329 [dailydave] 20120106 Apache Struts https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object. 20120105 SEC Consult SA-20120104-0 :: Multiple critical vulnerabilities in Apache Struts2 http://struts.apache.org/2.x/docs/s2-008.html http://struts.apache.org/2.x/docs/version-notes-2311.html 18329 https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt ** DISPUTED ** The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself." 20120105 SEC Consult SA-20120104-0 :: Multiple critical vulnerabilities in Apache Struts2 http://struts.apache.org/2.x/docs/s2-008.html http://struts.apache.org/2.x/docs/version-notes-2311.html 18329 31434 https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt Buffer overflow in the server in EMC NetWorker 7.5.x and 7.6.x before 7.6.3 SP1 Cumulative Release build 851 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via unspecified vectors. 20120126 ESA-2012-005: EMC NetWorker buffer overflow vulnerability EMC Documentum xPlore 1.0, 1.1 before P07, and 1.2 does not properly enforce the requirement for BROWSE permission, which allows remote authenticated users to determine the existence of an object, or read object metadata, via a search. 20120203 ESA-2012-010: EMC Documentum xPlore information disclosure vulnerability 1026639 51863 emc-documentum-info-disc(72994) Buffer overflow in EMC RSA SecurID Software Token Converter before 2.6.1 allows remote attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors. 20120305 ESA-2012-013: RSA SecurID(r) Software Token Converter buffer overflow vulnerability EMC Documentum eRoom before 7.4.4 does not properly validate session cookies, which allows remote attackers to hijack or replay sessions via unspecified vectors. 20120313 ESA-2012-012: EMC Documentum eRoom Multiple Vulnerabilities Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA enVision 4.x before 4.1 Patch 4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. 20120318 ESA-2012-014: RSA enVision Multiple Vulnerabilities 52557 1026819 EMC RSA enVision 4.x before 4.1 Patch 4 does not properly restrict the number of failed authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack. 20120318 ESA-2012-014: RSA enVision Multiple Vulnerabilities 52557 1026819 envision-weak-security(74140) Multiple SQL injection vulnerabilities in EMC RSA enVision 4.x before 4.1 Patch 4 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors. 20120318 ESA-2012-014: RSA enVision Multiple Vulnerabilities 52557 1026819 envision-unspec-sql-injection(74137) EMC RSA enVision 4.x before 4.1 Patch 4 uses unspecified hardcoded credentials, which makes it easier for remote attackers to obtain access via unknown vectors. 20120318 ESA-2012-014: RSA enVision Multiple Vulnerabilities 52557 1026819 envision-default-account(74138) Directory traversal vulnerability in EMC RSA enVision 4.x before 4.1 Patch 4 allows remote authenticated users to have an unspecified impact via unknown vectors. 20120318 ESA-2012-014: RSA enVision Multiple Vulnerabilities 52557 1026819 envision-unspec-dir-traversal(74139) Cross-site scripting (XSS) vulnerability in EMC Documentum eRoom before 7.4.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. 20120313 ESA-2012-012: EMC Documentum eRoom Multiple Vulnerabilities ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012. Notes: none. The DPA_Utilities.cProcessAuthenticationData function in EMC Data Protection Advisor (DPA) 5.5 through 5.8 SP1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an AUTHENTICATECONNECTION command that (1) lacks a password field or (2) has an empty password. http://aluigi.altervista.org/adv/dpa_1-adv.txt 18688 20120418 ESA-2012-018: EMC Data Protection Advisor Multiple Vulnerabilities 1026956 Integer overflow in the DPA_Utilities library in EMC Data Protection Advisor (DPA) 5.5 through 5.8 SP1 allows remote attackers to cause a denial of service (infinite loop) via a negative 64-bit value in a certain size field. http://aluigi.altervista.org/adv/dpa_1-adv.txt 18688 20120418 ESA-2012-018: EMC Data Protection Advisor Multiple Vulnerabilities 1026956 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012. Notes: none. Multiple buffer overflows in EMC AutoStart 5.3.x and 5.4.x before 5.4.3 allow remote attackers to cause a denial of service (agent crash) or possibly execute arbitrary code via crafted packets. 20120522 ESA-2012-020: EMC AutoStart Multiple Buffer Overflow Vulnerabilities 53682 1027100 Directory traversal vulnerability in WebAccess in Novell GroupWise before 8.03 allows remote attackers to read arbitrary files via the User.interface parameter. http://www.novell.com/support/kb/doc.php?id=7000708 1027217 https://bugzilla.novell.com/show_bug.cgi?id=712163 Unspecified vulnerability in Novell iPrint Client before 5.82 allows remote attackers to execute arbitrary code via an op-client-interface-version action. http://www.novell.com/support/kb/doc.php?id=7008708 Cross-site scripting (XSS) vulnerability in the Spacewalk service in SUSE Manager 1.2 for SUSE Linux Enterprise (SLE) 11 SP1 allows remote attackers to inject arbitrary web script or HTML via an image name. http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5145796.html https://bugzilla.novell.com/show_bug.cgi?id=761165 https://support.novell.com/security/cve/CVE-2012-0414.html Integer overflow in GroupWise Internet Agent (GWIA) in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 allows remote attackers to execute arbitrary code via unspecified vectors. http://download.novell.com/Download?buildid=O5hTjIiMdMo~ http://www.novell.com/support/kb/doc.php?id=7010770 1027599 https://bugzilla.novell.com/show_bug.cgi?id=740041 Unspecified vulnerability in the client in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 on Windows allows user-assisted remote attackers to execute arbitrary code via a crafted file. http://download.novell.com/Download?buildid=O5hTjIiMdMo~ http://www.novell.com/support/kb/doc.php?id=7010771 55729 https://bugzilla.novell.com/show_bug.cgi?id=752521 Directory traversal vulnerability in the agent HTTP interfaces in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 allows remote attackers to read arbitrary files via directory traversal sequences in a request. 20120921 DDIVRT-2012-42 Novell GroupWise Agents Arbitrary File Retrieval (CVE-2012-0419) http://download.novell.com/Download?buildid=O5hTjIiMdMo~ 20120921 DDIVRT-2012-42 Novell GroupWise Agents Arbitrary File Retrieval (CVE-2012-0419) http://www.novell.com/support/kb/doc.php?id=7010772 https://bugzilla.novell.com/show_bug.cgi?id=756330 https://bugzilla.novell.com/show_bug.cgi?id=756924 zypp-refresh-wrapper in SUSE Zypper before 1.3.20 and 1.6.x before 1.6.166 allows local users to create files in arbitrary directories, or possibly have unspecified other impact, via a pathname in the ZYPP_LOCKFILE_ROOT environment variable. https://bugzilla.novell.com/show_bug.cgi?id=770630 https://support.novell.com/security/cve/CVE-2012-0420.html The SUSE Audit Log Keeper daemon before 0.2.1-0.4.6.1 for SUSE Manager and Spacewalk uses world-readable permissions for /etc/auditlog-keeper.conf, which allows local users to obtain passwords by reading this file. SUSE-SU-2012:0958 https://bugzilla.novell.com/771335 LanItems.ycp in save_y2logs in yast2-network before 2.24.4 in SUSE YaST writes cleartext Wi-Fi credentials to the y2log log file, which allows context-dependent attackers to obtain sensitive information by reading the (1) WIRELESS_WPA_PASSWORD or (2) WIRELESS_CLIENT_KEY_PASSWORD field. https://bugzilla.novell.com/show_bug.cgi?id=752464 https://support.novell.com/security/cve/CVE-2012-0425.html Race condition in sap_suse_cluster_connector before 1.0.0-0.8.1 in SUSE Linux Enterprise for SAP Applications 11 SP2 allows local users to have an unspecified impact via vectors related to a tmp/ directory. http://download.novell.com/Download?buildid=DshQViDsMLE~ https://bugzilla.novell.com/show_bug.cgi?id=763793 https://bugzilla.novell.com/show_bug.cgi?id=777453 https://bugzilla.novell.com/show_bug.cgi?id=778273 https://bugzilla.novell.com/show_bug.cgi?id=778293 https://support.novell.com/security/cve/CVE-2012-0426.html yast2-add-on-creator in SUSE inst-source-utils 2008.11.26 before 2008.11.26-0.9.1 and 2012.9.13 before 2012.9.13-0.8.1 allows local users to gain privileges via a crafted (1) file name or (2) directory name. OpenSuse 11.4 is vulnerable per https://bugzilla.novell.com/show_bug.cgi?id=604730 http://download.novell.com/Download?buildid=tGCXHQR48E4~ https://bugzilla.novell.com/show_bug.cgi?id=604730 https://support.novell.com/security/cve/CVE-2012-0427.html Cross-site scripting (XSS) vulnerability in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://www.novell.com/support/kb/doc.php?id=3426981 http://www.novell.com/support/kb/doc.php?id=7011539 1027911 https://bugzilla.novell.com/show_bug.cgi?id=772899 dhost in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 on Windows allows remote authenticated users to cause a denial of service (daemon crash) via crafted characters in an HTTP request. http://www.novell.com/support/kb/doc.php?id=3426981 http://www.novell.com/support/kb/doc.php?id=7011533 1027912 https://bugzilla.novell.com/show_bug.cgi?id=772895 Unspecified vulnerability in NetIQ eDirectory 8.8.6.x before 8.8.6.7 and 8.8.7.x before 8.8.7.2 on Windows allows remote attackers to obtain an administrator cookie and bypass authorization checks via unknown vectors. http://www.novell.com/support/kb/doc.php?id=3426981 http://www.novell.com/support/kb/doc.php?id=7011538 1027910 https://bugzilla.novell.com/show_bug.cgi?id=772898 Stack-based buffer overflow in the Novell NCP implementation in NetIQ eDirectory 8.8.7.x before 8.8.7.2 allows remote attackers to have an unspecified impact via unknown vectors. http://www.novell.com/support/kb/doc.php?id=3426981 https://bugzilla.novell.com/show_bug.cgi?id=785272 The install-chef-suse.sh script shipped with crowbar before 2012-10-02 is creating files containing confidential data with insecure permissions, allowing local users to read confidential data. https://bugzilla.suse.com/show_bug.cgi?id=783195 https://www.suse.com/security/cve/CVE-2012-0433/ The server in Crowbar, as used in SUSE Cloud 1.0, uses weak permissions for the production.log file, which has unspecified impact and attack vectors. https://bugzilla.novell.com/show_bug.cgi?id=784857 https://support.novell.com/security/cve/CVE-2012-0434.html https://www.suse.com/support/update/announcement/2013/suse-ru-20130020-1.html SUSE WebYaST before 1.2 0.2.63-0.6.1 allows remote attackers to modify the hosts list, and subsequently conduct man-in-the-middle attacks, via a crafted /host request on TCP port 4984. SUSE-SU-2013:0053 http://support.novell.com/security/cve/CVE-2012-0435.html VU#806908 https://bugzilla.novell.com/show_bug.cgi?id=792712 An ActiveX control in gwcls1.dll in the client in Novell GroupWise 8.0 before 8.0.3 HP2 and 2012 before SP1 HP1 allows remote attackers to execute arbitrary code via (1) a pointer argument to the SetEngine method or (2) an XPItem pointer argument to an unspecified method. http://www.novell.com/support/kb/doc.php?id=7011688 http://www.zerodayinitiative.com/advisories/ZDI-13-008/ https://bugzilla.novell.com/show_bug.cgi?id=712144 https://bugzilla.novell.com/show_bug.cgi?id=743674 Cross-site request forgery (CSRF) vulnerability in jsonrpc.cgi in Bugzilla 3.5.x and 3.6.x before 3.6.8, 3.7.x and 4.0.x before 4.0.4, and 4.1.x and 4.2.x before 4.2rc2 allows remote attackers to hijack the authentication of arbitrary users for requests that use the JSON-RPC API. http://www.bugzilla.org/security/3.4.13/ 1026623 https://bugzilla.mozilla.org/show_bug.cgi?id=718319 bugzilla-jsonrpc-csrf(72882) The ASN.1 decoder in the QuickDER decoder in Mozilla Network Security Services (NSS) before 3.13.4, as used in Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10, allows remote attackers to cause a denial of service (application crash) via a zero-length item, as demonstrated by (1) a zero-length basic constraint or (2) a zero-length field in an OCSP response. SUSE-SU-2012:0746 openSUSE-SU-2012:0760 DSA-2490 MDVSA-2012:088 http://www.mozilla.org/security/announce/2012/mfsa2012-39.html http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html 53798 USN-1540-1 USN-1540-2 https://bugzilla.mozilla.org/show_bug.cgi?id=715073 oval:org.mitre.oval:def:16701 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. SUSE-SU-2012:0198 SUSE-SU-2012:0221 openSUSE-SU-2012:0234 DSA-2400 DSA-2402 DSA-2406 MDVSA-2012:013 http://www.mozilla.org/security/announce/2012/mfsa2012-01.html https://bugzilla.mozilla.org/show_bug.cgi?id=693399 https://bugzilla.mozilla.org/show_bug.cgi?id=705347 oval:org.mitre.oval:def:14678 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. openSUSE-SU-2012:0234 MDVSA-2012:013 http://www.mozilla.org/security/announce/2012/mfsa2012-01.html https://bugzilla.mozilla.org/show_bug.cgi?id=665578 https://bugzilla.mozilla.org/show_bug.cgi?id=684938 https://bugzilla.mozilla.org/show_bug.cgi?id=692817 https://bugzilla.mozilla.org/show_bug.cgi?id=695076 https://bugzilla.mozilla.org/show_bug.cgi?id=696748 https://bugzilla.mozilla.org/show_bug.cgi?id=707051 https://bugzilla.mozilla.org/show_bug.cgi?id=711651 https://bugzilla.mozilla.org/show_bug.cgi?id=712169 https://bugzilla.mozilla.org/show_bug.cgi?id=712289 https://bugzilla.mozilla.org/show_bug.cgi?id=713209 https://bugzilla.mozilla.org/show_bug.cgi?id=714600 https://bugzilla.mozilla.org/show_bug.cgi?id=715662 oval:org.mitre.oval:def:14444 Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize nsChildView data structures, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted Ogg Vorbis file. SUSE-SU-2012:0198 SUSE-SU-2012:0221 openSUSE-SU-2012:0234 48043 48095 DSA-2400 DSA-2402 DSA-2406 MDVSA-2012:013 http://www.mozilla.org/security/announce/2012/mfsa2012-07.html 51753 USN-1370-1 https://bugzilla.mozilla.org/show_bug.cgi?id=719612 mozilla-nschildview-code-exec(72858) oval:org.mitre.oval:def:14464 Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to bypass the HTML5 frame-navigation policy and replace arbitrary sub-frames by creating a form submission target with a sub-frame's name attribute. openSUSE-SU-2012:0234 MDVSA-2012:013 http://www.mozilla.org/security/announce/2012/mfsa2012-03.html 51765 https://bugzilla.mozilla.org/show_bug.cgi?id=701071 mozilla-iframeelement-security-bypass(72835) oval:org.mitre.oval:def:14907 Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to inject arbitrary web script or HTML via a (1) web page or (2) Firefox extension, related to improper enforcement of XPConnect security restrictions for frame scripts that call untrusted objects. openSUSE-SU-2012:0234 MDVSA-2012:013 http://www.mozilla.org/security/announce/2012/mfsa2012-05.html 51752 https://bugzilla.mozilla.org/show_bug.cgi?id=705651 mozilla-xpconnect-xss(72837) oval:org.mitre.oval:def:14304 Mozilla Firefox 4.x through 9.0, Thunderbird 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize data for image/vnd.microsoft.icon images, which allows remote attackers to obtain potentially sensitive information by reading a PNG image that was created through conversion from an ICO image. openSUSE-SU-2012:0234 MDVSA-2012:013 http://www.mozilla.org/security/announce/2012/mfsa2012-06.html https://bugzilla.mozilla.org/show_bug.cgi?id=710079 mozilla-mimagebuffersize-info-disclosure(72856) oval:org.mitre.oval:def:14912 Bugzilla 2.x and 3.x before 3.4.14, 3.5.x and 3.6.x before 3.6.8, 3.7.x and 4.0.x before 4.0.4, and 4.1.x and 4.2.x before 4.2rc2 does not reject non-ASCII characters in e-mail addresses of new user accounts, which makes it easier for remote authenticated users to spoof other user accounts by choosing a similar e-mail address. http://www.bugzilla.org/security/3.4.13/ 51784 1026623 https://bugzilla.mozilla.org/show_bug.cgi?id=714472 bugzilla-unspecified-spoofing(72877) Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a malformed XSLT stylesheet that is embedded in a document. SUSE-SU-2012:0198 SUSE-SU-2012:0221 openSUSE-SU-2012:0234 DSA-2400 DSA-2402 DSA-2406 MDVSA-2012:013 http://www.mozilla.org/security/announce/2012/mfsa2012-08.html 51754 https://bugzilla.mozilla.org/show_bug.cgi?id=701806 https://bugzilla.mozilla.org/show_bug.cgi?id=702466 mozilla-xsltstylesheets-code-execution(72868) oval:org.mitre.oval:def:14618 Mozilla Firefox 4.x through 9.0 and SeaMonkey before 2.7 on Linux and Mac OS X set weak permissions for Firefox Recovery Key.html, which might allow local users to read a Firefox Sync key via standard filesystem operations. openSUSE-SU-2012:0234 MDVSA-2012:013 http://www.mozilla.org/security/announce/2012/mfsa2012-09.html https://bugzilla.mozilla.org/show_bug.cgi?id=716868 mozilla-keyhtml-info-disclosure(72869) oval:org.mitre.oval:def:14670 CRLF injection vulnerability in Mozilla Firefox 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 allows remote web servers to bypass intended Content Security Policy (CSP) restrictions and possibly conduct cross-site scripting (XSS) attacks via crafted HTTP headers. SUSE-SU-2012:0424 openSUSE-SU-2012:0417 RHSA-2012:0387 RHSA-2012:0388 48359 48402 MDVSA-2012:032 http://www.mozilla.org/security/announce/2012/mfsa2012-15.html 52463 1026801 1026803 1026804 USN-1400-1 USN-1400-2 USN-1400-3 USN-1400-4 USN-1400-5 https://bugzilla.mozilla.org/show_bug.cgi?id=717511 oval:org.mitre.oval:def:14909 Use-after-free vulnerability in Mozilla Firefox 10.x before 10.0.1, Thunderbird 10.x before 10.0.1, and SeaMonkey 2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors that trigger failure of an nsXBLDocumentInfo::ReadPrototypeBindings function call, related to the cycle collector's access to a hash table containing a stale XBL binding. openSUSE-SU-2012:0258 SUSE-SU-2012:0261 48110 MDVSA-2012:017 MDVSA-2012:018 http://www.mozilla.org/security/announce/2012/mfsa2012-10.html 51975 USN-1360-1 https://bugzilla.mozilla.org/show_bug.cgi?id=724284 oval:org.mitre.oval:def:15017 Cross-site request forgery (CSRF) vulnerability in xmlrpc.cgi in Bugzilla 4.0.2 through 4.0.4 and 4.1.1 through 4.2rc2, when mod_perl is used, allows remote attackers to hijack the authentication of arbitrary users for requests that modify the product's installation via the XML-RPC API. http://www.bugzilla.org/security/4.0.4/ 1026737 https://bugzilla.mozilla.org/show_bug.cgi?id=725663 Use-after-free vulnerability in Mozilla Firefox 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 on 32-bit Windows 7 platforms allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via vectors involving use of the file-open dialog in a child window, related to the IUnknown_QueryService function in the Windows shlwapi.dll library. SUSE-SU-2012:0424 48402 MDVSA-2012:032 http://www.mozilla.org/security/announce/2012/mfsa2012-12.html 1026801 1026803 1026804 https://bugzilla.mozilla.org/show_bug.cgi?id=684555 oval:org.mitre.oval:def:14258 Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 do not properly restrict drag-and-drop operations on javascript: URLs, which allows user-assisted remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web page, related to a "DragAndDropJacking" issue. SUSE-SU-2012:0424 SUSE-SU-2012:0425 openSUSE-SU-2012:0417 RHSA-2012:0387 RHSA-2012:0388 48359 48402 48414 DSA-2433 DSA-2458 MDVSA-2012:031 MDVSA-2012:032 http://www.mozilla.org/security/announce/2012/mfsa2012-13.html 52458 1026801 1026803 1026804 USN-1400-1 USN-1400-2 USN-1400-3 USN-1400-4 USN-1400-5 USN-1401-1 https://bugzilla.mozilla.org/show_bug.cgi?id=704354 oval:org.mitre.oval:def:14829 The SVG Filters implementation in Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 might allow remote attackers to obtain sensitive information from process memory via vectors that trigger an out-of-bounds read. SUSE-SU-2012:0424 SUSE-SU-2012:0425 openSUSE-SU-2012:0417 RHSA-2012:0387 RHSA-2012:0388 48359 48402 48414 DSA-2433 DSA-2458 MDVSA-2012:031 MDVSA-2012:032 http://www.mozilla.org/security/announce/2012/mfsa2012-14.html 1026801 1026803 1026804 USN-1400-1 USN-1400-2 USN-1400-3 USN-1400-4 USN-1400-5 USN-1401-1 https://bugzilla.mozilla.org/show_bug.cgi?id=711653 oval:org.mitre.oval:def:15007 Use-after-free vulnerability in the nsSMILTimeValueSpec::ConvertBetweenTimeContainer function in Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 might allow remote attackers to execute arbitrary code via an SVG animation. SUSE-SU-2012:0424 SUSE-SU-2012:0425 openSUSE-SU-2012:0417 RHSA-2012:0387 RHSA-2012:0388 48359 48402 48414 MDVSA-2012:031 MDVSA-2012:032 http://www.mozilla.org/security/announce/2012/mfsa2012-14.html 1026801 1026803 1026804 USN-1400-1 USN-1400-2 USN-1400-3 USN-1400-4 USN-1400-5 USN-1401-1 https://bugzilla.mozilla.org/show_bug.cgi?id=720103 oval:org.mitre.oval:def:14775 Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 do not properly restrict setting the home page through the dragging of a URL to the home button, which allows user-assisted remote attackers to execute arbitrary JavaScript code with chrome privileges via a javascript: URL that is later interpreted in the about:sessionrestore context. SUSE-SU-2012:0424 SUSE-SU-2012:0425 openSUSE-SU-2012:0417 RHSA-2012:0387 RHSA-2012:0388 48359 48402 48414 DSA-2433 DSA-2458 MDVSA-2012:031 MDVSA-2012:032 http://www.mozilla.org/security/announce/2012/mfsa2012-16.html 52460 1026801 1026803 1026804 USN-1400-1 USN-1400-2 USN-1400-3 USN-1400-4 USN-1400-5 USN-1401-1 https://bugzilla.mozilla.org/show_bug.cgi?id=718203 https://bugzilla.mozilla.org/show_bug.cgi?id=719994 https://bugzilla.mozilla.org/show_bug.cgi?id=723808 oval:org.mitre.oval:def:15122 The Cascading Style Sheets (CSS) implementation in Mozilla Firefox 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via dynamic modification of a keyframe followed by access to the cssText of the keyframe. SUSE-SU-2012:0424 openSUSE-SU-2012:0417 RHSA-2012:0387 RHSA-2012:0388 48359 48402 MDVSA-2012:032 http://www.mozilla.org/security/announce/2012/mfsa2012-17.html 1026801 1026803 1026804 USN-1400-1 USN-1400-2 USN-1400-3 USN-1400-4 USN-1400-5 https://bugzilla.mozilla.org/show_bug.cgi?id=723446 oval:org.mitre.oval:def:15066 Mozilla Firefox 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 do not properly restrict write access to the window.fullScreen object, which allows remote attackers to spoof the user interface via a crafted web page. SUSE-SU-2012:0424 openSUSE-SU-2012:0417 RHSA-2012:0387 RHSA-2012:0388 48359 48402 MDVSA-2012:032 http://www.mozilla.org/security/announce/2012/mfsa2012-18.html 1026801 1026803 1026804 USN-1400-1 USN-1400-2 USN-1400-3 USN-1400-4 USN-1400-5 https://bugzilla.mozilla.org/show_bug.cgi?id=727303 oval:org.mitre.oval:def:15114 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. SUSE-SU-2012:0424 SUSE-SU-2012:0425 openSUSE-SU-2012:0417 RHSA-2012:0387 RHSA-2012:0388 48359 48402 48414 DSA-2433 DSA-2458 MDVSA-2012:031 MDVSA-2012:032 http://www.mozilla.org/security/announce/2012/mfsa2012-19.html 1026801 1026803 1026804 USN-1400-1 USN-1400-2 USN-1400-3 USN-1400-4 USN-1400-5 USN-1401-1 https://bugzilla.mozilla.org/show_bug.cgi?id=657588 https://bugzilla.mozilla.org/show_bug.cgi?id=730425 oval:org.mitre.oval:def:15009 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. SUSE-SU-2012:0424 SUSE-SU-2012:0425 openSUSE-SU-2012:0417 RHSA-2012:0387 RHSA-2012:0388 48359 48402 MDVSA-2012:032 http://www.mozilla.org/security/announce/2012/mfsa2012-19.html 1026801 1026803 1026804 USN-1400-1 USN-1400-2 USN-1400-3 USN-1400-4 USN-1400-5 https://bugzilla.mozilla.org/show_bug.cgi?id=699033 https://bugzilla.mozilla.org/show_bug.cgi?id=701269 https://bugzilla.mozilla.org/show_bug.cgi?id=705855 https://bugzilla.mozilla.org/show_bug.cgi?id=712572 https://bugzilla.mozilla.org/show_bug.cgi?id=714590 https://bugzilla.mozilla.org/show_bug.cgi?id=718202 https://bugzilla.mozilla.org/show_bug.cgi?id=718516 https://bugzilla.mozilla.org/show_bug.cgi?id=720380 https://bugzilla.mozilla.org/show_bug.cgi?id=727330 oval:org.mitre.oval:def:15012 The nsWindow implementation in the browser engine in Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 does not check the validity of an instance after event dispatching, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors, as demonstrated by Mobile Firefox on Android. SUSE-SU-2012:0424 SUSE-SU-2012:0425 openSUSE-SU-2012:0417 48402 http://www.mozilla.org/security/announce/2012/mfsa2012-19.html 52466 1026801 1026803 1026804 https://bugzilla.mozilla.org/show_bug.cgi?id=688208 oval:org.mitre.oval:def:15143 Use-after-free vulnerability in the browser engine in Mozilla Firefox before 3.6.28 and 4.x through 10.0, Firefox ESR 10.x before 10.0.3, Thunderbird before 3.1.20 and 5.0 through 10.0, Thunderbird ESR 10.x before 10.0.3, and SeaMonkey before 2.8 allows remote attackers to execute arbitrary code via vectors involving an empty argument to the array.join function in conjunction with the triggering of garbage collection. SUSE-SU-2012:0424 SUSE-SU-2012:0425 openSUSE-SU-2012:0417 http://pwn2own.zerodayinitiative.com/status.html RHSA-2012:0387 RHSA-2012:0388 48359 48402 48414 MDVSA-2012:031 MDVSA-2012:032 http://www.mozilla.org/security/announce/2012/mfsa2012-19.html 52465 1026801 1026803 1026804 USN-1400-1 USN-1400-2 USN-1400-3 USN-1400-4 USN-1400-5 USN-1401-1 http://www.zdnet.com/blog/security/mozilla-knew-of-pwn2own-bug-before-cansecwest/10757 http://www.zdnet.com/blog/security/researchers-hack-into-newest-firefox-with-zero-day-flaw/10663 https://bugzilla.mozilla.org/show_bug.cgi?id=720079 https://bugzilla.mozilla.org/show_bug.cgi?id=735104 oval:org.mitre.oval:def:14170 Bugzilla 3.5.x and 3.6.x before 3.6.9, 3.7.x and 4.0.x before 4.0.6, and 4.1.x and 4.2.x before 4.2.1, when the inbound_proxies option is enabled, does not properly validate the X-Forwarded-For HTTP header, which allows remote attackers to bypass the lockout policy via a series of authentication requests with (1) different IP address strings in this header or (2) a long string in this header. 20120418 Security advisory for Bugzilla 4.2.1, 4.0.6 and 3.6.9 FEDORA-2012-6368 FEDORA-2012-6396 FEDORA-2012-6282 https://bugzilla.mozilla.org/show_bug.cgi?id=728639 template/en/default/list/list.js.tmpl in Bugzilla 2.x and 3.x before 3.6.9, 3.7.x and 4.0.x before 4.0.6, and 4.1.x and 4.2.x before 4.2.1 does not properly handle multiple logins, which allows remote attackers to conduct cross-site scripting (XSS) attacks and obtain sensitive bug information via a crafted web page. 20120418 Security advisory for Bugzilla 4.2.1, 4.0.6 and 3.6.9 FEDORA-2012-6368 FEDORA-2012-6396 FEDORA-2012-6282 https://bugzilla.mozilla.org/show_bug.cgi?id=745397 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. DSA-2457 DSA-2458 DSA-2464 MDVSA-2012:066 MDVSA-2012:081 http://www.mozilla.org/security/announce/2012/mfsa2012-20.html 53223 https://bugzilla.mozilla.org/show_bug.cgi?id=680456 https://bugzilla.mozilla.org/show_bug.cgi?id=706381 https://bugzilla.mozilla.org/show_bug.cgi?id=708825 https://bugzilla.mozilla.org/show_bug.cgi?id=714614 https://bugzilla.mozilla.org/show_bug.cgi?id=716556 https://bugzilla.mozilla.org/show_bug.cgi?id=720305 https://bugzilla.mozilla.org/show_bug.cgi?id=723453 https://bugzilla.mozilla.org/show_bug.cgi?id=726332 https://bugzilla.mozilla.org/show_bug.cgi?id=726502 https://bugzilla.mozilla.org/show_bug.cgi?id=732941 https://bugzilla.mozilla.org/show_bug.cgi?id=732951 https://bugzilla.mozilla.org/show_bug.cgi?id=733282 https://bugzilla.mozilla.org/show_bug.cgi?id=733979 https://bugzilla.mozilla.org/show_bug.cgi?id=735073 https://bugzilla.mozilla.org/show_bug.cgi?id=735943 https://bugzilla.mozilla.org/show_bug.cgi?id=736589 https://bugzilla.mozilla.org/show_bug.cgi?id=736609 https://bugzilla.mozilla.org/show_bug.cgi?id=737129 https://bugzilla.mozilla.org/show_bug.cgi?id=737182 https://bugzilla.mozilla.org/show_bug.cgi?id=737384 https://bugzilla.mozilla.org/show_bug.cgi?id=737875 https://bugzilla.mozilla.org/show_bug.cgi?id=740595 oval:org.mitre.oval:def:17074 The browser engine in Mozilla Firefox 4.x through 11.0, Thunderbird 5.0 through 11.0, and SeaMonkey before 2.9 allows remote attackers to cause a denial of service (assertion failure and memory corruption) or possibly execute arbitrary code via vectors related to jsval.h and the js::array_shift function. MDVSA-2012:066 MDVSA-2012:081 http://www.mozilla.org/security/announce/2012/mfsa2012-20.html 53221 https://bugzilla.mozilla.org/show_bug.cgi?id=714616 oval:org.mitre.oval:def:16771 Use-after-free vulnerability in the mozilla::dom::indexedDB::IDBKeyRange::cycleCollection::Trace function in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to execute arbitrary code via vectors related to crafted IndexedDB data. MDVSA-2012:066 MDVSA-2012:081 http://www.mozilla.org/security/announce/2012/mfsa2012-22.html 53220 https://bugzilla.mozilla.org/show_bug.cgi?id=738985 oval:org.mitre.oval:def:16734 Heap-based buffer overflow in the nsSVGFEDiffuseLightingElement::LightPixel function in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to cause a denial of service (invalid gfxImageSurface free operation) or possibly execute arbitrary code by leveraging the use of "different number systems." DSA-2457 DSA-2458 DSA-2464 MDVSA-2012:066 MDVSA-2012:081 http://www.mozilla.org/security/announce/2012/mfsa2012-23.html 53225 https://bugzilla.mozilla.org/show_bug.cgi?id=734288 oval:org.mitre.oval:def:16989 Cross-site scripting (XSS) vulnerability in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to inject arbitrary web script or HTML via a multibyte character set. DSA-2457 DSA-2458 DSA-2464 MDVSA-2012:066 MDVSA-2012:081 http://www.mozilla.org/security/announce/2012/mfsa2012-24.html 53219 https://bugzilla.mozilla.org/show_bug.cgi?id=715319 oval:org.mitre.oval:def:16961 The cairo-dwrite implementation in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9, when certain Windows Vista and Windows 7 configurations are used, does not properly restrict font-rendering attempts, which allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors. MDVSA-2012:066 MDVSA-2012:081 http://www.mozilla.org/security/announce/2012/mfsa2012-25.html 53218 https://bugzilla.mozilla.org/show_bug.cgi?id=744480 oval:org.mitre.oval:def:17067 The WebGLBuffer::FindMaxUshortElement function in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 calls the FindMaxElementInSubArray function with incorrect template arguments, which allows remote attackers to obtain sensitive information from video memory via a crafted WebGL.drawElements call. MDVSA-2012:066 MDVSA-2012:081 http://www.mozilla.org/security/announce/2012/mfsa2012-26.html 53231 https://bugzilla.mozilla.org/show_bug.cgi?id=743475 oval:org.mitre.oval:def:16113 Cross-site scripting (XSS) vulnerability in the docshell implementation in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to inject arbitrary web script or HTML via vectors related to short-circuited page loads, aka "Universal XSS (UXSS)." MDVSA-2012:066 MDVSA-2012:081 http://www.mozilla.org/security/announce/2012/mfsa2012-27.html 53228 https://bugzilla.mozilla.org/show_bug.cgi?id=687745 https://bugzilla.mozilla.org/show_bug.cgi?id=737307 oval:org.mitre.oval:def:16107 Mozilla Firefox 4.x through 11.0, Thunderbird 5.0 through 11.0, and SeaMonkey before 2.9 do not properly construct the Origin and Sec-WebSocket-Origin HTTP headers, which might allow remote attackers to bypass an IPv6 literal ACL via a cross-site (1) XMLHttpRequest or (2) WebSocket operation involving a nonstandard port number and an IPv6 address that contains certain zero fields. http://www.mozilla.org/security/announce/2012/mfsa2012-28.html 53230 https://bugzilla.mozilla.org/show_bug.cgi?id=694576 firefox-websocket-sec-bypass(75153) oval:org.mitre.oval:def:16279 Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allow remote attackers to inject arbitrary web script or HTML via the (1) ISO-2022-KR or (2) ISO-2022-CN character set. DSA-2457 DSA-2458 DSA-2464 MDVSA-2012:066 MDVSA-2012:081 http://www.mozilla.org/security/announce/2012/mfsa2012-29.html 53229 https://bugzilla.mozilla.org/show_bug.cgi?id=718573 firefox-iso2022kr-xss(75154) oval:org.mitre.oval:def:16889 The texImage2D implementation in the WebGL subsystem in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 does not properly restrict JSVAL_TO_OBJECT casts, which might allow remote attackers to execute arbitrary code via a crafted web page. MDVSA-2012:066 MDVSA-2012:081 http://www.mozilla.org/security/announce/2012/mfsa2012-30.html 53227 https://bugzilla.mozilla.org/show_bug.cgi?id=727547 firefox-teximage2d-dos(75155) oval:org.mitre.oval:def:16893 Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allow remote attackers to spoof the address bar via an https URL for invalid (1) RSS or (2) Atom XML content. DSA-2457 DSA-2458 DSA-2464 MDVSA-2012:066 MDVSA-2012:081 http://www.mozilla.org/security/announce/2012/mfsa2012-33.html 53224 https://bugzilla.mozilla.org/show_bug.cgi?id=714631 firefox-rss-spoofing(75156) oval:org.mitre.oval:def:17011 Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x, 5.1.x, and 5.5.x allows remote authenticated users to affect confidentiality via unknown vectors. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659687 SUSE-SU-2012:0984 48250 GLSA-201308-06 DSA-2429 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html 51515 USN-1397-1 mysql-server-info-disc(72525) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0112, CVE-2012-0115, CVE-2012-0119, CVE-2012-0120, and CVE-2012-0492. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659687 48250 GLSA-201308-06 DSA-2429 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html 51513 USN-1397-1 mysql-serveruns4-dos(72526) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0117, CVE-2012-0487, CVE-2012-0488, CVE-2012-0489, CVE-2012-0491, CVE-2012-0493, and CVE-2012-0495. GLSA-201308-06 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html 51514 USN-1397-1 mysql-serveruns5-dos(72527) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0117, CVE-2012-0486, CVE-2012-0488, CVE-2012-0489, CVE-2012-0491, CVE-2012-0493, and CVE-2012-0495. GLSA-201308-06 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html 51503 USN-1397-1 mysql-serveruns6-dos(72528) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0117, CVE-2012-0486, CVE-2012-0487, CVE-2012-0489, CVE-2012-0491, CVE-2012-0493, and CVE-2012-0495. GLSA-201308-06 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html 51506 USN-1397-1 mysql-serveruns7-dos(72529) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0117, CVE-2012-0486, CVE-2012-0487, CVE-2012-0488, CVE-2012-0491, CVE-2012-0493, and CVE-2012-0495. GLSA-201308-06 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html 51510 USN-1397-1 mysql-serveruns8-dos(72530) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.0.x, 5.1.x, and 5.5.x allows remote authenticated users to affect availability via unknown vectors. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659687 SUSE-SU-2012:0984 48250 GLSA-201308-06 DSA-2429 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html 51524 USN-1397-1 mysql-serveruns9-dos(72531) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0117, CVE-2012-0486, CVE-2012-0487, CVE-2012-0488, CVE-2012-0489, CVE-2012-0493, and CVE-2012-0495. GLSA-201308-06 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html 51518 USN-1397-1 mysql-serveruns10-dos(72532) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.x and 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0112, CVE-2012-0115, CVE-2012-0119, CVE-2012-0120, and CVE-2012-0485. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659687 48250 GLSA-201308-06 DSA-2429 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html 51516 USN-1397-1 mysql-serveruns14-dos(72537) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0117, CVE-2012-0486, CVE-2012-0487, CVE-2012-0488, CVE-2012-0489, CVE-2012-0491, and CVE-2012-0495. GLSA-201308-06 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html USN-1397-1 mysql-serveruns15-dos(72538) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.x allows local users to affect availability via unknown vectors. GLSA-201308-06 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html USN-1397-1 mysql-serveruns16-dos(72540) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.x allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-0117, CVE-2012-0486, CVE-2012-0487, CVE-2012-0488, CVE-2012-0489, CVE-2012-0491, and CVE-2012-0493. GLSA-201308-06 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html USN-1397-1 mysql-serveruns11-dos(72533) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.x allows remote authenticated users to affect confidentiality and integrity via unknown vectors. GLSA-201308-06 http://www.oracle.com/technetwork/topics/security/cpujan2012-366304.html USN-1397-1 mysql-server-cve20120496(72518) Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, and 6 Update 30 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Per: http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html 'Applies to client and server deployments of Java. This vulnerability can be exploited through Untrusted Java Web Start applications and Untrusted Java applets. It can also be exploited by supplying data to APIs in the specified Component without using untrusted Java Web Start applications or untrusted Java applets, such as through a web service.' SUSE-SU-2012:0603 HPSBUX02757 HPSBUX02784 HPSBMU02799 SSRT100867 RHSA-2012:0514 RHSA-2013:1455 48074 GLSA-201406-32 DSA-2420 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html 52009 oval:org.mitre.oval:def:14772 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Per: http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html 'Applies to client and server deployments of Java. This vulnerability can be exploited through Untrusted Java Web Start applications and Untrusted Java applets. It can also be exploited by supplying data to APIs in the specified Component without using untrusted Java Web Start applications or untrusted Java applets, such as through a web service.' SUSE-SU-2012:0602 SUSE-SU-2012:0603 HPSBUX02757 SSRT100805 HPSBUX02784 HPSBMU02799 SSRT100867 RHSA-2012:0508 RHSA-2012:0514 RHSA-2013:1455 48073 48074 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html 52019 oval:org.mitre.oval:def:15075 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.2_35 and earlier; and JavaFX 2.0.2 and earlier; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Per: http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html 'Applies to client and server deployments of Java. This vulnerability can be exploited through Untrusted Java Web Start applications and Untrusted Java applets. It can also be exploited by supplying data to APIs in the specified Component without using untrusted Java Web Start applications or untrusted Java applets, such as through a web service.' SUSE-SU-2012:0602 SUSE-SU-2012:0603 SUSE-SU-2012:0734 SUSE-SU-2012:0881 SUSE-SU-2012:1013 HPSBUX02757 SSRT100805 HPSBUX02777 HPSBUX02784 HPSBMU02799 SSRT100867 RHSA-2012:0508 RHSA-2012:0514 RHSA-2012:0702 RHSA-2012:1080 RHSA-2013:1455 48073 48074 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html 52016 oval:org.mitre.oval:def:14878 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and JavaFX 2.0.2 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Per: http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html 'Applies to client deployments of Java. This vulnerability can be exploited only through Untrusted Java Web Start applications and Untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)' SUSE-SU-2012:0603 HPSBUX02757 HPSBUX02784 HPSBMU02799 SSRT100867 RHSA-2012:0514 RHSA-2013:1455 48073 http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html 52015 oval:org.mitre.oval:def:14844 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect availability via unknown vectors. Per: http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html 'Applies to client deployments of Java. This vulnerability can be exploited only through Untrusted Java Web Start applications and Untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)' SUSE-SU-2012:0602 SUSE-SU-2012:0603 HPSBUX02757 SSRT100805 HPSBUX02784 HPSBMU02799 SSRT100867 RHSA-2012:0508 RHSA-2012:0514 RHSA-2013:1455 48073 48074 GLSA-201406-32 DSA-2420 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html 52013 oval:org.mitre.oval:def:15069 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.2_35 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality and availability, related to AWT. Per: http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html 'Applies to client deployments of Java. This vulnerability can be exploited only through Untrusted Java Web Start applications and Untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)' SUSE-SU-2012:0602 SUSE-SU-2012:0603 SUSE-SU-2012:0734 SUSE-SU-2012:0881 SUSE-SU-2012:1013 HPSBUX02757 SSRT100805 HPSBUX02777 HPSBUX02784 HPSBMU02799 SSRT100867 RHSA-2012:0508 RHSA-2012:0514 RHSA-2012:0702 RHSA-2012:1080 RHSA-2013:1455 48073 48074 GLSA-201406-32 DSA-2420 http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html 52011 oval:org.mitre.oval:def:14900 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.2_35 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability, related to I18n. Per: http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html 'Applies to client deployments of Java. This vulnerability can be exploited only through Untrusted Java Web Start applications and Untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)' SUSE-SU-2012:0602 SUSE-SU-2012:0603 SUSE-SU-2012:0734 SUSE-SU-2012:0881 SUSE-SU-2012:1013 HPSBUX02757 SSRT100805 HPSBUX02777 HPSBUX02784 HPSBMU02799 SSRT100867 RHSA-2012:0508 RHSA-2012:0514 RHSA-2012:0702 RHSA-2012:1080 RHSA-2013:1455 48073 48074 GLSA-201406-32 DSA-2420 http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html 52018 oval:org.mitre.oval:def:14813 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, and 6 Update 30 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install and the Java Update mechanism. Per: http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html 'Applies to client deployments of Java. This vulnerability is in the Java Update mechanism.' HPSBUX02757 HPSBUX02784 HPSBMU02799 SSRT100867 http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html 52020 oval:org.mitre.oval:def:14890 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5 Update 33 and earlier, and 1.4.2_35 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Serialization. Per: http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html 'Applies to client deployments of Java. This vulnerability can be exploited only through Untrusted Java Web Start applications and Untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)' SUSE-SU-2012:0602 SUSE-SU-2012:0603 SUSE-SU-2012:0734 SUSE-SU-2012:0881 SUSE-SU-2012:1013 HPSBUX02757 SSRT100805 HPSBUX02777 HPSBUX02784 HPSBMU02799 SSRT100867 RHSA-2012:0508 RHSA-2012:0514 RHSA-2012:0702 RHSA-2012:1080 RHSA-2013:1455 48073 48074 GLSA-201406-32 DSA-2420 http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html 52017 oval:org.mitre.oval:def:13976 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, 5.0 Update 33 and earlier, and 1.4.2_35 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect integrity via unknown vectors related to CORBA. Per: http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html 'Applies to client deployments of Java. This vulnerability can be exploited only through Untrusted Java Web Start applications and Untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)' SUSE-SU-2012:0602 SUSE-SU-2012:0603 SUSE-SU-2012:0734 SUSE-SU-2012:0881 SUSE-SU-2012:1013 HPSBUX02757 SSRT100805 HPSBUX02777 HPSBUX02784 HPSBMU02799 SSRT100867 RHSA-2012:0508 RHSA-2012:0514 RHSA-2012:0702 RHSA-2012:1080 RHSA-2013:1455 48073 48074 GLSA-201406-32 DSA-2420 http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html 52014 oval:org.mitre.oval:def:14082 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions. NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue. Per: http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html 'Applies to client deployments of Java. This vulnerability can be exploited only through Untrusted Java Web Start applications and Untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)' http://blogs.technet.com/b/mmpc/archive/2012/03/20/an-interesting-case-of-jre-sandbox-breach-cve-2012-0507.aspx http://krebsonsecurity.com/2012/03/new-java-attack-rolled-into-exploit-packs/ SUSE-SU-2012:0602 SUSE-SU-2012:0603 HPSBUX02757 SSRT100805 HPSBUX02784 HPSBMU02799 SSRT100867 RHSA-2012:0508 RHSA-2012:0514 RHSA-2013:1455 http://weblog.ikvm.net/PermaLink.aspx?guid=cd48169a-9405-4f63-9087-798c4a1866d3 DSA-2420 http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html 52161 https://bugzilla.redhat.com/show_bug.cgi?id=788994 Unspecified vulnerability in the JavaFX component in Oracle Java SE JavaFX, 1.3.0 and earlier, and 1.2.2 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. Per: http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html 'Applies to client deployments of Java.' HPSBMU02799 SSRT100867 SSRT100919 http://www.oracle.com/technetwork/topics/security/javacpufeb2012-366318.html Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 5.0.2 and 5.3.0 through 5.3.4 allows remote authenticated users to affect integrity via unknown vectors related to Core-Base. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53096 1026953 Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, and 11.1.0.7 allows remote attackers to affect integrity and availability via unknown vectors. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 1026929 Unspecified vulnerability in the OCI component in Oracle Database Server 10.2.0.3, 10.2.0.4, and 11.1.0.7 allows remote attackers to affect confidentiality and integrity via unknown vectors. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 1026929 Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Database Server 11.1.0.7 and 11.2.0.2 and Oracle Enterprise Manager Grid Control allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Enterprise Config Management. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 1026929 Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.0.6 and 12.1.3 allows remote attackers to affect integrity, related to REST Services. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53055 1026936 Unspecified vulnerability in the PeopleSoft Enterprise CRM component in Oracle PeopleSoft Products 9.1 allows remote authenticated users to affect confidentiality, related to SEC. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53080 1026954 Unspecified vulnerability in the Identity Manager Connector component in Oracle Fusion Middleware 9.1.0.4 allows remote authenticated users to affect integrity via unknown vectors. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53079 1026949 Unspecified vulnerability in the Oracle iPlanet Web Server component in Oracle Sun Products Suite 7.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Administration Console. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53133 1026951 Unspecified vulnerability in the PeopleSoft Enterprise HRMS component in Oracle PeopleSoft Products 9.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to eCompensation Manager Desktop. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53057 1026954 Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects, a different vulnerability than CVE-2012-3175. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.2.0.2, when running on Windows, allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53072 1026929 Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, and 11.2.0.2, and in Oracle Enterprise Manager Grid Control 10.2.0.5 and 11.1.0.1, allows remote attackers to affect integrity via unknown vectors related to Security Framework. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53081 1026929 Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.1 Bundle #9 allows remote authenticated users to affect confidentiality via unknown vectors related to Human Resources. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53091 1026954 Unspecified vulnerability in the Oracle JDeveloper component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect integrity via unknown vectors related to Java Business Objects. 48863 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53053 1026949 Unspecified vulnerability in the Oracle Grid Engine component in Oracle Sun Products Suite 6.1 and 6.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to sgepasswd. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 1026950 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.50, 8.51, and 8.52 allows local users to affect confidentiality and integrity via unknown vectors related to File Processing. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53127 1026954 Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Database Server 11.1.0.7, 11.2.0.2, and 11.2.0.3, and Oracle Enterprise Manager Grid Control 10.2.0.5 and 11.1.0.1, allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Enterprise Config Management. SUSE-SU-2012:1020 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 1026929 Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3, and Oracle Enterprise Manager Grid Control 10.2.0.5, allows remote attackers to affect integrity via unknown vectors related to Schema Management, a different vulnerability than CVE-2012-0527. SUSE-SU-2012:1020 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 1026929 Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3, and Oracle Enterprise Manager Grid Control 10.2.0.5, allows remote attackers to affect integrity via unknown vectors related to Schema Management, a different vulnerability than CVE-2012-0526. SUSE-SU-2012:1020 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 1026929 Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, and 11.1.0.7, and Oracle Enterprise Manager Grid Control, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Security Framework. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 1026929 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.51 allows remote authenticated users to affect integrity via unknown vectors related to core. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 1026954 Unspecified vulnerability in the PeopleSoft Enterprise SCM component in Oracle PeopleSoft Products 9.0 and 9.1 allows remote authenticated users to affect integrity via unknown vectors related to eProcurement. 48884 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53110 1026954 Unspecified vulnerability in the PeopleSoft Enterprise Portal component in Oracle PeopleSoft Products 9.1 allows remote authenticated users to affect integrity via unknown vectors related to Enterprise Portal. 48883 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53124 1026954 Unspecified vulnerability in the Identity Manager component in Oracle Fusion Middleware 11.1.1.3 and 11.1.1.5 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to User Config Management. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53060 1026949 Unspecified vulnerability in the PeopleSoft Enterprise FCSM component in Oracle PeopleSoft Products 9.0 and 9.1 allows remote authenticated users to affect confidentiality via unknown vectors related to Receivables. 48880 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53088 1026954 Unspecified vulnerability in the RDBMS Core component in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote authenticated users to affect integrity via unknown vectors related to Create Session. SUSE-SU-2012:1020 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 1026929 Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.0.6 and 12.1.3 allows remote attackers to affect confidentiality via unknown vectors related to Change Password Page. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53059 1026936 Unspecified vulnerability in the PeopleSoft Enterprise HRMS component in Oracle PeopleSoft Products 8.9 through Bundle #26 allows remote authenticated users to affect confidentiality via unknown vectors related to eCompensation. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53099 1026954 Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.1.3 allows remote attackers to affect confidentiality and integrity, related to HTML pages. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53066 1026936 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.50, 8.51, and 8.52 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Search. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53065 1026954 Unspecified vulnerability in Oracle Sun Solaris 8, 9, and 10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to (1) bsmconv and (2) bsmunconv. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 1026940 Unspecified vulnerability in Oracle MySQL Server 5.1.62 and earlier and 5.5.23 and earlier allows remote authenticated users to affect availability, related to GIS Extension. RHSA-2012:1462 GLSA-201308-06 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54551 1027263 mysql-gisextension-dos(77061) Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 5.0.2, 5.3.0 through 5.3.4, 6.0.1, and 6.2.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Core-My Services. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53100 1026953 Unspecified vulnerability in the Oracle iStore component in Oracle E-Business Suite 11.5.10.2, 12.0.4, 12.0.6, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Runtime Catalog. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53068 1026936 Unspecified vulnerability in the BI Publisher (formerly XML Publisher) component in Oracle Fusion Middleware 10.1.3.4.1 and 10.1.3.4.2 allows remote attackers to affect integrity via unknown vectors related to Administration. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53083 1026949 Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Software 10.0.0 through 10.5.0 and 11.0.0 through 11.4.0 allows remote authenticated users to affect integrity via unknown vectors related to Core, a different vulnerability than CVE-2012-0571. http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53106 1026953 Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Software 10.0.0 through 10.5.0 and 11.0.0 through 11.2.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Core, a different vulnerability than CVE-2012-0546 and CVE-2012-0567. http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53122 1026953 Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Software 10.0.0 through 10.5.0 and 11.0.0 through 11.2.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Core, a different vulnerability than CVE-2012-0545 and CVE-2012-0567. http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53108 1026953 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier, and 6 Update 34 and earlier, has no impact and remote attack vectors involving AWT and "a security-in-depth issue that is not directly exploitable but which can be used to aggravate security vulnerabilities that can be directly exploited." NOTE: this identifier was assigned by the Oracle CNA, but CVE is not intended to cover defense-in-depth issues that are only exposed by the presence of other vulnerabilities. NOTE: Oracle has not commented on claims from a downstream vendor that this issue is related to "toolkit internals references." SUSE-SU-2012:1148 openSUSE-SU-2012:1175 SUSE-SU-2012:1231 HPSBUX02825 RHSA-2012:1222 RHSA-2012:1225 RHSA-2012:1392 RHSA-2012:1466 RHSA-2013:1455 RHSA-2013:1456 GLSA-201406-32 http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-023/index.html http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html 55339 USN-1553-1 SSRT100970 Unspecified vulnerability in Oracle SPARC Enterprise M Series Servers XCP 1110 and earlier allows local users to affect confidentiality, related to XSCF Control Package (XCP). MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53134 1026942 Unspecified vulnerability in the Oracle AutoVue Office component in Oracle Supply Chain Products Suite 20.1.1 allows remote attackers to affect confidentiality, integrity, and availability, related to Desktop API. 48875 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 1026937 Unspecified vulnerability in the GlassFish Enterprise Server component in Oracle Sun Products Suite GlassFish Enterprise Server 3.1.1 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Web Container. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 1026941 Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE 7 update 4 and earlier and 6 update 32 and earlier, and the GlassFish Enterprise Server component in Oracle Sun Products Suite GlassFish Enterprise Server 3.1.1, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Web Container or Deployment. SUSE-SU-2012:1231 SUSE-SU-2012:1265 SSRT100919 RHSA-2012:0734 RHSA-2013:1455 RHSA-2013:1456 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html 53136 1026941 oval:org.mitre.oval:def:16707 Unspecified vulnerability in the Oracle Spatial component in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors. SUSE-SU-2012:1020 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 1026929 Buffer overflow in yaSSL, as used in MySQL 5.1.x before 5.1.68 and 5.5.x before 5.5.28, has unspecified impact and attack vectors, a different vulnerability than CVE-2013-1492. http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-68.html GLSA-201308-06 https://blogs.oracle.com/sunsecurity/entry/cve_2012_0553_buffer_overflow Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.5 and 8.3.7 allows remote attackers to affect confidentiality, integrity, and availability, related to Outside In Image Export SDK, a different vulnerability than CVE-2012-0555, CVE-2012-0556, and CVE-2012-0557. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53069 1026949 http://www-01.ibm.com/support/docview.wss?uid=swg21660640 Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.5 and 8.3.7 allows remote attackers to affect confidentiality, integrity, and availability, related to Outside In Image Export SDK, a different vulnerability than CVE-2012-0554, CVE-2012-0556, and CVE-2012-0557. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53070 1026949 http://www-01.ibm.com/support/docview.wss?uid=swg21660640 Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.5 and 8.3.7 allows remote attackers to affect confidentiality, integrity, and availability, related to Outside In Image Export SDK, a different vulnerability than CVE-2012-0554, CVE-2012-0555, and CVE-2012-0557. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53087 1026949 http://www-01.ibm.com/support/docview.wss?uid=swg21660640 Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.5 and 8.3.7 allows remote attackers to affect confidentiality, integrity, and availability, related to Outside In Image Export SDK, a different vulnerability than CVE-2012-0554, CVE-2012-0555, and CVE-2012-0556. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53054 1026949 http://www-01.ibm.com/support/docview.wss?uid=swg21660640 Unspecified vulnerability in the Primavera P6 Enterprise Project Portfolio Management component in Oracle Primavera Products Suite 6.2.1, 8.0, 8.1, and 8.2 allows remote attackers to affect integrity via unknown vectors related to Web application. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53056 1026943 Unspecified vulnerability in the PeopleSoft Enterprise SCM component in Oracle PeopleSoft Products 9.0 and 9.1 allows remote authenticated users to affect confidentiality via unknown vectors related to Billing. 48884 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53105 1026954 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.50, 8.51, and 8.52 allows remote attackers to affect integrity via unknown vectors related to Portal. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53073 1026954 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.50, 8.51, and 8.52 allows remote authenticated users to affect integrity, related to PIA Core Technology. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53115 1026954 Unspecified vulnerability in the PeopleSoft Enterprise HRMS component in Oracle PeopleSoft Products 9.1 allows remote authenticated users to affect confidentiality via unknown vectors related to Candidate Gateway, a different vulnerability than CVE-2012-1748. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53095 1026954 Unspecified vulnerability in Oracle Solaris 9, 10, and 11 allows local users to affect availability via unknown vectors related to Kerberos/klist. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54557 1027274 solaris-kerberosklist-dos(77056) Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.50 and 8.51 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Query. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53051 1026954 Unspecified vulnerability in the Oracle Agile component in Oracle Supply Chain Products Suite 5.2.2, 6.0.0, and 6.1.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Install. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53078 1026937 Unspecified vulnerability in the Oracle Agile component in Oracle Supply Chain Products Suite 5.2.2, 6.0.0, and 6.1.1 allows remote attackers to affect integrity via unknown vectors related to Supplier Portal. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53086 1026937 Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Software 10.0.0 through 10.5.0 and 11.0.0 through 11.2.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Core, a different vulnerability than CVE-2012-0545 and CVE-2012-0546. http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53114 1026953 Unspecified vulnerability in Oracle Sun Solaris 8, 9, and 10 allows local users to affect confidentiality via unknown vectors related to Utility/fdformat. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html oval:org.mitre.oval:def:19399 Unspecified vulnerability Oracle Sun Solaris 10 allows local users to affect confidentiality and integrity via unknown vectors related to Install/smpatch. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf oval:org.mitre.oval:def:19359 Unspecified vulnerability in Oracle Sun Solaris 8, 9, 10, and 11 allows local users to affect availability via unknown vectors related to Libraries/Libc. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html 59241 oval:org.mitre.oval:def:19326 Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Software 10.0.0 through 10.5.0 and 11.0.0 through 11.4.0 allows remote authenticated users to affect integrity via unknown vectors related to Core, a different vulnerability than CVE-2012-0544. http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53103 1026953 Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier and 5.5.28 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB. RHSA-2013:0219 GLSA-201308-06 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html USN-1703-1 oval:org.mitre.oval:def:16792 Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Software 10.0.0 through 10.5.0 and 11.0.0 through 11.4.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Core. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53129 1026953 Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows remote authenticated users to affect availability via unknown vectors. SSRT100970 RHSA-2013:0219 GLSA-201308-06 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html USN-1703-1 oval:org.mitre.oval:def:17266 Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Software 10.0.0 through 10.5.0 and 11.0.0 through 11.2.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Core. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53111 1026953 Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 6.0.1 and 6.2.0 allows remote authenticated users to affect integrity via unknown vectors related to Core-Help. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53113 1026953 Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Software 10.0.0 through 10.5.0 and 11.0.0 through 11.4.0 allows remote authenticated users to affect availability via unknown vectors related to Core. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53112 1026953 Unspecified vulnerability in the Server component in Oracle MySQL 5.5.28 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer. GLSA-201308-06 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html USN-1703-1 oval:org.mitre.oval:def:16947 Unspecified vulnerability in the Oracle FLEXCUBE Universal Banking component in Oracle Financial Services Software 10.0.0 through 10.5.0 and 11.0.0 through 11.4.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Core. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53109 1026953 Unspecified vulnerability in the Oracle Agile PLM for Process component in Oracle Supply Chain Products Suite 5.2.2, 6.0.0, and 6.1.1 allows remote attackers to affect integrity via unknown vectors related to Supplier Portal. 48853 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53085 1026937 Unspecified vulnerability in the Oracle Agile component in Oracle Supply Chain Products Suite 5.2.2, 6.0.0, and 6.1.1 allows remote attackers to affect integrity, related to SCRM - Company Profiles. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 1026937 Unspecified vulnerability in the Siebel Clinical component in Oracle Industry Applications 7.7, 7.8, 8.0.0.x, 8.1.1.x, and 8.2.2.x allows remote authenticated users to affect integrity via unknown vectors related to Web UI, a different vulnerability than CVE-2012-1674. 48885 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53050 1026952 Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.60 and earlier, and 5.5.19 and earlier, allows remote authenticated users to affect availability, related to MyISAM. GLSA-201308-06 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53061 1026934 The Internationalized Domain Name (IDN) feature in Apple Safari before 5.1.4 on Windows does not properly restrict the characters in URLs, which allows remote attackers to spoof a domain name via unspecified homoglyphs. APPLE-SA-2012-03-12-1 80088 48377 1026785 The Private Browsing feature in Safari in Apple iOS before 5.1 allows remote attackers to bypass intended privacy settings and insert history entries via JavaScript code that calls the (1) pushState or (2) replaceState method. APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 79964 48288 48377 1026774 appleios-browsing-sec-bypass(73871) Cross-site scripting (XSS) vulnerability in WebKit, as used in Apple iOS before 5.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0587, CVE-2012-0588, and CVE-2012-0589. APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48288 48377 1026774 Cross-site scripting (XSS) vulnerability in WebKit, as used in Apple iOS before 5.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0586, CVE-2012-0588, and CVE-2012-0589. APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48288 48377 1026774 Cross-site scripting (XSS) vulnerability in WebKit, as used in Apple iOS before 5.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0586, CVE-2012-0587, and CVE-2012-0589. APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48288 48377 1026774 Cross-site scripting (XSS) vulnerability in WebKit, as used in Apple iOS before 5.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0586, CVE-2012-0587, and CVE-2012-0588. APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48288 48377 1026774 Cross-site scripting (XSS) vulnerability in WebKit, as used in Apple iOS before 5.1, allows user-assisted remote attackers to inject arbitrary web script or HTML via vectors involving a drag-and-drop operation. APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48288 48377 1026774 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 apple-webkit-cve20120591-code-execution(73810) oval:org.mitre.oval:def:17158 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 oval:org.mitre.oval:def:17488 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 apple-webkit-cve20120593-code-execution(73812) oval:org.mitre.oval:def:17427 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 apple-webkit-cve20120594-code-execution(73813) oval:org.mitre.oval:def:16941 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 apple-webkit-cve20120595-code-execution(73814) oval:org.mitre.oval:def:17057 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 apple-webkit-cve20120596-code-execution(73815) oval:org.mitre.oval:def:16974 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 apple-webkit-cve20120597-code-execution(73816) oval:org.mitre.oval:def:16879 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 apple-webkit-cve20120598-code-execution(73817) oval:org.mitre.oval:def:17375 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 apple-webkit-cve20120599-code-execution(73818) oval:org.mitre.oval:def:17204 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 apple-webkit-cve20120600-code-execution(73819) oval:org.mitre.oval:def:17471 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 apple-webkit-cve20120601-code-execution(73820) oval:org.mitre.oval:def:17464 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 apple-webkit-cve20120602-code-execution(73821) oval:org.mitre.oval:def:17287 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 apple-webkit-cve20120603-code-execution(73822) oval:org.mitre.oval:def:17387 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 apple-webkit-cve20120604-code-execution(73823) oval:org.mitre.oval:def:17486 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 apple-webkit-cve20120605-code-execution(73824) oval:org.mitre.oval:def:17060 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 apple-webkit-cve20120606-code-execution(73825) oval:org.mitre.oval:def:17168 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 apple-webkit-cve20120607-code-execution(73826) oval:org.mitre.oval:def:17174 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 apple-webkit-cve20120608-code-execution(73827) oval:org.mitre.oval:def:16726 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 apple-webkit-cve20120609-code-execution(73828) oval:org.mitre.oval:def:17434 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 apple-webkit-cve20120610-code-execution(73829) oval:org.mitre.oval:def:17152 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 apple-webkit-cve20120611-code-execution(73830) oval:org.mitre.oval:def:17366 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 apple-webkit-cve20120612-code-execution(73831) oval:org.mitre.oval:def:17156 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 apple-webkit-cve20120613-code-execution(73832) oval:org.mitre.oval:def:17473 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 apple-webkit-cve20120614-code-execution(73833) oval:org.mitre.oval:def:16756 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 apple-webkit-cve20120615-code-execution(73834) oval:org.mitre.oval:def:17185 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 apple-webkit-cve20120616-code-execution(73835) oval:org.mitre.oval:def:17331 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 apple-webkit-cve20120617-code-execution(73836) oval:org.mitre.oval:def:17048 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 oval:org.mitre.oval:def:17128 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 oval:org.mitre.oval:def:17302 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 oval:org.mitre.oval:def:17271 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 oval:org.mitre.oval:def:17432 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 oval:org.mitre.oval:def:17282 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 oval:org.mitre.oval:def:17431 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 oval:org.mitre.oval:def:17319 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 oval:org.mitre.oval:def:17364 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 oval:org.mitre.oval:def:16862 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 oval:org.mitre.oval:def:17429 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 oval:org.mitre.oval:def:17458 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 oval:org.mitre.oval:def:17419 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 oval:org.mitre.oval:def:17082 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 oval:org.mitre.oval:def:16826 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 oval:org.mitre.oval:def:16678 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 oval:org.mitre.oval:def:16980 WebKit, as used in Apple iTunes before 10.6, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2012-03-07-1. APPLE-SA-2012-03-07-1 48274 52363 oval:org.mitre.oval:def:17365 WebKit, as used in Apple iOS before 5.1 and iTunes before 10.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-03-07-1 and APPLE-SA-2012-03-07-2. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-07-2 APPLE-SA-2012-03-12-1 48274 48288 48377 52365 1026774 oval:org.mitre.oval:def:17169 WebKit, as used in Apple iTunes before 10.6, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2012-03-07-1. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-12-1 48274 48377 52363 oval:org.mitre.oval:def:17068 WebKit, as used in Apple iTunes before 10.6, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2012-03-07-1. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-12-1 48274 48377 52363 oval:org.mitre.oval:def:17469 WebKit, as used in Apple iTunes before 10.6, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2012-03-07-1. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-12-1 48274 48377 52363 oval:org.mitre.oval:def:17138 WebKit, as used in Apple iTunes before 10.6, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2012-03-07-1. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-12-1 48274 48377 52363 oval:org.mitre.oval:def:17263 WebKit in Apple Safari before 5.1.4 does not properly implement "From third parties and advertisers" cookie blocking, which makes it easier for remote web servers to track users via a cookie. APPLE-SA-2012-03-12-1 48377 1026785 CFNetwork in Apple iOS before 5.1 does not properly construct request headers during parsing of URLs, which allows remote attackers to obtain sensitive information via a malformed URL, a different vulnerability than CVE-2011-3447. APPLE-SA-2012-03-07-2 48288 1026774 Integer underflow in Apple iOS before 5.1 allows remote attackers to execute arbitrary code or cause a denial of service (device crash) via a crafted catalog file in an HFS disk image. APPLE-SA-2012-03-07-2 APPLE-SA-2012-05-09-1 48288 http://support.apple.com/kb/HT5281 1026774 The kernel in Apple iOS before 5.1 does not properly handle debug system calls, which allows remote attackers to bypass sandbox restrictions and execute arbitrary code via a crafted program. APPLE-SA-2012-03-07-2 APPLE-SA-2012-09-19-2 48288 http://support.apple.com/kb/HT5501 1026774 Race condition in the Passcode Lock feature in Apple iOS before 5.1 allows physically proximate attackers to bypass intended passcode requirements via a slide-to-dial gesture. APPLE-SA-2012-03-07-2 48288 1026774 Siri in Apple iOS before 5.1 does not properly restrict the ability of Mail.app to handle voice commands, which allows physically proximate attackers to bypass the locked state via a command that forwards an active e-mail message to an arbitrary recipient. APPLE-SA-2012-03-07-2 48288 1026774 Format string vulnerability in VPN in Apple iOS before 5.1 allows remote attackers to execute arbitrary code via a crafted racoon configuration file. APPLE-SA-2012-03-07-2 48288 1026774 WebKit in Apple Safari before 5.1.4 does not properly handle redirects in conjunction with HTTP authentication, which might allow remote web servers to capture credentials by logging the Authorization HTTP header. APPLE-SA-2012-03-12-1 48377 1026785 WebKit, as used in Apple iTunes before 10.6, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2012-03-07-1. APPLE-SA-2012-03-07-1 APPLE-SA-2012-03-12-1 48274 48377 52363 oval:org.mitre.oval:def:17475 Race condition in the initialization routine in blued in Bluetooth in Apple Mac OS X before 10.7.4 allows local users to gain privileges via vectors involving a temporary file. APPLE-SA-2012-05-09-1 http://support.apple.com/kb/HT5281 53445 53456 Buffer overflow in the DirectoryService Proxy in DirectoryService in Apple Mac OS X through 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors. APPLE-SA-2012-09-19-2 http://support.apple.com/kb/HT5501 The directory server in Directory Service in Apple Mac OS X 10.6.8 allows remote attackers to obtain sensitive information from process memory via a crafted message. APPLE-SA-2012-05-09-1 http://support.apple.com/kb/HT5281 53445 53458 Login Window in Apple Mac OS X 10.7.3, when Legacy File Vault or networked home directories are enabled, does not properly restrict what is written to the system log for network logins, which allows local users to obtain sensitive information by reading the log. APPLE-SA-2012-05-09-1 APPLE-SA-2012-09-19-2 http://support.apple.com/kb/HT5281 http://support.apple.com/kb/HT5501 53445 53457 1027024 libsecurity in Apple Mac OS X before 10.7.4 accesses uninitialized memory locations during the processing of X.509 certificates, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted certificate. APPLE-SA-2012-05-09-1 http://support.apple.com/kb/HT5281 53445 53471 libsecurity in Apple Mac OS X before 10.7.4 does not properly restrict the length of RSA keys within X.509 certificates, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by conducting a spoofing or network-sniffing attack during communication with a site that uses a short key. APPLE-SA-2012-05-09-1 http://support.apple.com/kb/HT5281 53445 53462 Race condition in LoginUIFramework in Apple Mac OS X 10.7.x before 10.7.4, when the Guest account is enabled, allows physically proximate attackers to login to arbitrary accounts by entering the account name and no password. APPLE-SA-2012-05-09-1 http://support.apple.com/kb/HT5281 53445 53459 Quartz Composer in Apple Mac OS X before 10.7.4, when the RSS Visualizer screensaver is enabled, allows physically proximate attackers to bypass screen locking and launch a Safari process via unspecified vectors. APPLE-SA-2012-05-09-1 http://support.apple.com/kb/HT5281 53445 53473 Buffer overflow in QuickTime in Apple Mac OS X before 10.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted audio sample tables in a movie file that is progressively downloaded. APPLE-SA-2012-05-09-1 APPLE-SA-2012-05-15-1 http://support.apple.com/kb/HT5261 http://support.apple.com/kb/HT5281 53445 53465 Integer overflow in QuickTime in Apple Mac OS X before 10.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MPEG file. APPLE-SA-2012-05-09-1 APPLE-SA-2012-05-15-1 http://support.apple.com/kb/HT5261 http://support.apple.com/kb/HT5281 53445 53467 Buffer underflow in QuickTime in Apple Mac OS X before 10.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MPEG file. APPLE-SA-2012-05-09-1 APPLE-SA-2012-05-15-1 http://support.apple.com/kb/HT5261 http://support.apple.com/kb/HT5281 53445 53469 Use-after-free vulnerability in QuickTime in Apple Mac OS X 10.7.x before 10.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with JPEG2000 encoding. APPLE-SA-2012-05-09-1 APPLE-SA-2012-05-15-1 http://support.apple.com/kb/HT5261 http://support.apple.com/kb/HT5281 53445 53466 Integer overflow in the Security Framework in Apple Mac OS X before 10.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via crafted input. APPLE-SA-2012-05-09-1 http://support.apple.com/kb/HT5281 53445 53468 Multiple stack-based buffer overflows in Apple QuickTime before 7.7.2 on Windows allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TeXML file. APPLE-SA-2012-05-15-1 http://support.apple.com/kb/HT5261 53571 1027065 oval:org.mitre.oval:def:16006 Heap-based buffer overflow in Apple QuickTime before 7.7.2 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted text track in a movie file. APPLE-SA-2012-05-15-1 http://support.apple.com/kb/HT5261 53574 1027065 oval:org.mitre.oval:def:16148 Heap-based buffer overflow in Apple QuickTime before 7.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with H.264 encoding. APPLE-SA-2012-05-15-1 http://support.apple.com/kb/HT5261 53576 1027065 oval:org.mitre.oval:def:15938 Stack-based buffer overflow in the plugin in Apple QuickTime before 7.7.2 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted QTMovie object. APPLE-SA-2012-05-15-1 http://support.apple.com/kb/HT5261 53577 1027065 oval:org.mitre.oval:def:16123 Integer signedness error in Apple QuickTime before 7.7.2 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted QTVR movie file. APPLE-SA-2012-05-15-1 http://support.apple.com/kb/HT5261 53583 1027065 oval:org.mitre.oval:def:15858 Buffer overflow in Apple QuickTime before 7.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with RLE encoding. APPLE-SA-2012-05-15-1 APPLE-SA-2012-09-19-2 http://support.apple.com/kb/HT5261 http://support.apple.com/kb/HT5501 53579 1027065 oval:org.mitre.oval:def:15821 Buffer overflow in Apple QuickTime before 7.7.2 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with Sorenson encoding. APPLE-SA-2012-05-15-1 http://support.apple.com/kb/HT5261 53580 1027065 oval:org.mitre.oval:def:16119 Integer overflow in Apple QuickTime before 7.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted sean atom in a movie file. APPLE-SA-2012-05-15-1 APPLE-SA-2012-09-19-2 http://support.apple.com/kb/HT5261 http://support.apple.com/kb/HT5501 53582 1027065 oval:org.mitre.oval:def:16111 Apple QuickTime before 7.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted .pict file. APPLE-SA-2012-05-15-1 APPLE-SA-2012-09-19-2 http://support.apple.com/kb/HT5261 http://support.apple.com/kb/HT5501 53584 1027065 oval:org.mitre.oval:def:15219 WebKit in Apple iOS before 5.1.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. APPLE-SA-2012-06-11-1 APPLE-SA-2012-05-07-1 APPLE-SA-2012-05-09-2 http://support.apple.com/kb/HT5282 53404 appleios-webkit-code-execution(75431) Safari in Apple iOS before 5.1.1 allows remote attackers to spoof the location bar's URL via a crafted web site. APPLE-SA-2012-05-07-1 Time Machine in Apple Mac OS X before 10.7.4 does not require continued use of SRP-based authentication after this authentication method is first used, which allows remote attackers to read Time Capsule credentials by spoofing the backup volume. APPLE-SA-2012-05-09-1 http://support.apple.com/kb/HT5281 53445 WebKit in Apple Safari before 5.1.7 does not properly track state information during the processing of form input, which allows remote attackers to fill in form fields on the pages of arbitrary web sites via unspecified vectors. APPLE-SA-2012-05-09-2 http://support.apple.com/kb/HT5282 1027053 safari-webkit-tracking-sec-bypass(75474) Heap-based buffer overflow in Apple iTunes before 10.6.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted .m3u playlist. APPLE-SA-2012-06-11-1 oval:org.mitre.oval:def:17016 Cross-site scripting (XSS) vulnerability in Apple Safari before 6.0 allows remote attackers to inject arbitrary web script or HTML via a feed:// URL. APPLE-SA-2012-07-25-1 http://support.apple.com/kb/HT5400 Apple Safari before 6.0 allows remote attackers to read arbitrary files via a feed:// URL. APPLE-SA-2012-07-25-1 http://support.apple.com/kb/HT5400 Apple Safari before 6.0 does not properly handle the autocomplete attribute of a password input element, which allows remote attackers to bypass authentication by leveraging an unattended workstation. APPLE-SA-2012-07-25-1 APPLE-SA-2012-09-19-1 http://support.apple.com/kb/HT5400 http://support.apple.com/kb/HT5503 54688 Apple Remote Desktop before 3.6.1 does not recognize the "Encrypt all network data" setting during connections to third-party VNC servers, which allows remote attackers to obtain cleartext VNC session content by sniffing the network. APPLE-SA-2012-08-20-1 http://support.apple.com/kb/HT5433 55100 WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1. APPLE-SA-2012-07-25-1 APPLE-SA-2012-09-12-1 APPLE-SA-2012-09-19-1 http://support.apple.com/kb/HT5400 http://support.apple.com/kb/HT5485 http://support.apple.com/kb/HT5503 WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1. APPLE-SA-2012-07-25-1 APPLE-SA-2012-09-12-1 APPLE-SA-2012-09-19-1 http://support.apple.com/kb/HT5400 http://support.apple.com/kb/HT5485 http://support.apple.com/kb/HT5503 Integer overflow in XnViewer (aka XnView) before 1.98.5 allows remote attackers to execute arbitrary code via a crafted file containing PSD record types, a different vulnerability than CVE-2012-0685. http://technet.microsoft.com/en-us/security/msvr/msvr12-001 Integer overflow in XnViewer (aka XnView) before 1.98.5 allows remote attackers to execute arbitrary code via a crafted file containing PSD record types, a different vulnerability than CVE-2012-0684. http://technet.microsoft.com/en-us/security/msvr/msvr12-001 TIBCO ActiveMatrix Runtime Platform in Service Grid and Service Bus 2.x before 2.3.2 and BusinessWorks Service Engine before 5.8.2; TIBCO ActiveMatrix Platform in TIBCO Silver Fabric ActiveMatrix Service Grid Distribution 3.1.3, Service Grid and Service Bus 3.x before 3.1.5, BusinessWorks Service Engine 5.9.x before 5.9.3, and BPM before 1.3.0; TIBCO BusinessEvents Runtime in Enterprise and Inference Editions 3.x before 3.0.3, Standard Edition 4.x before 4.0.2, and Standard Edition and Express 5.0.0; and TIBCO BusinessWorks Engine in TIBCO Silver Fabric ActiveMatrix BusinessWorks Distribution 5.9.2 and ActiveMatrix BusinessWorks before 5.9.3 allow remote attackers to obtain sensitive information via a crafted URL. http://www.tibco.com/multimedia/activematrix2_advisory_20120308_tcm8-15726.txt http://www.tibco.com/multimedia/activematrix3_advisory_20120308_tcm8-15728.txt http://www.tibco.com/multimedia/businessevents_advisory_20120308_tcm8-15729.txt http://www.tibco.com/multimedia/businessworks_advisory_20120308_tcm8-15730.txt http://www.tibco.com/services/support/advisories/amx-be-spotfire-advisory_20120308.jsp Cross-site scripting (XSS) vulnerability in TIBCO ActiveMatrix Platform in TIBCO Silver Fabric ActiveMatrix Service Grid Distribution 3.1.3, Service Grid and Service Bus 3.x before 3.1.5, BusinessWorks Service Engine 5.9.x before 5.9.3, and BPM before 1.3.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://www.tibco.com/multimedia/activematrix3_advisory_20120308_tcm8-15728.txt http://www.tibco.com/services/support/advisories/amx-be-spotfire-advisory_20120308.jsp The server in TIBCO ActiveMatrix Platform in TIBCO Silver Fabric ActiveMatrix Service Grid Distribution 3.1.3, Service Grid and Service Bus 3.x before 3.1.5, BusinessWorks Service Engine 5.9.x before 5.9.3, and BPM before 1.3.0 allows remote attackers to discover credentials via unspecified vectors. http://www.tibco.com/multimedia/activematrix3_advisory_20120308_tcm8-15728.txt http://www.tibco.com/services/support/advisories/amx-be-spotfire-advisory_20120308.jsp TIBCO Spotfire Web Application, Web Player Application, Automation Services Application, and Analytics Client Application in Spotfire Analytics Server before 10.1.2; Server before 3.3.3; and Web Player, Automation Services, and Professional before 4.0.2 allow remote attackers to obtain sensitive information via a crafted URL. http://www.tibco.com/multimedia/spotfire_advisory_20120308_tcm8-15731.txt http://www.tibco.com/services/support/advisories/amx-be-spotfire-advisory_20120308.jsp CA License (aka CA Licensing) before 1.90.03 does not properly restrict system commands, which allows local users to gain privileges via unspecified vectors. 20121001 CA20121001-01: Security Notice for CA License 1027588 CA License (aka CA Licensing) before 1.90.03 allows local users to modify or create arbitrary files, and consequently gain privileges, via unspecified vectors. 20121001 CA20121001-01: Security Notice for CA License 1027588 ** DISPUTED ** submitticket.php in WHMCompleteSolution (WHMCS) 5.03 allows remote attackers to inject arbitrary code into a subject field via crafted ticket data, a different vulnerability than CVE-2011-5061. NOTE: the vendor disputes this issue, noting that some of the details overlap CVE-2011-5061, but that it "says it affects V5.0.3, and the submitticket.php file, both of which are wrong." http://www.oscommerceuniversity.com/lounge/index.php/board,23.0.html http://www.oscommerceuniversity.com/lounge/index.php/topic,1209.0.html Multiple unspecified vulnerabilities in Google Chrome before 17.0.963.27 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors. http://googlechromereleases.blogspot.com/2012/01/beta-channel-update-for-chromebooks.html oval:org.mitre.oval:def:14268 Multiple cross-site scripting (XSS) vulnerabilities in the Executive Viewer (EV) in IBM Cognos TM1 before 9.5 FP1 allow remote attackers to inject arbitrary web script or HTML via unspecified requests to (1) aspnet_client or (2) evserver/createcontrol.js. 1026491 51326 PM26682 cevtm1-aspnetclient-createcontrol-xss(72198) HP StorageWorks P2000 G3 MSA array systems have a default account, which makes it easier for remote attackers to perform administrative tasks via unspecified vectors, a different vulnerability than CVE-2011-4788. 20120112 ZDI-12-015 : (0Day) HP StorageWorks P2000 G3 Directory Traversal and Default Account Vulnerabilities http://zerodayinitiative.com/advisories/ZDI-12-015/ storageworks-array-default-account(72372) tcsd in TrouSerS before 0.3.10 allows remote attackers to cause a denial of service (daemon crash) via a crafted type_offset value in a TCP packet to port 30003. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=692649 http://packetstormsecurity.com/files/118281/TrouSerS-Denial-Of-Service.html http://sourceforge.net/tracker/index.php?func=detail&aid=3473554&group_id=126012&atid=704358 http://trousers.git.sourceforge.net/git/gitweb.cgi?p=trousers/trousers;a=commit;h=50dd06a6f639b76b3bb629606ef71b2dc5407601 http://trousers.git.sourceforge.net/git/gitweb.cgi?p=trousers/trousers;a=commit;h=ae0c2f8c1fd7a96ba0191f83b6057f8cbc51e786 DSA-2576 22904 https://blogs.oracle.com/sunsecurity/entry/cve_2012_0698_denial_of https://bugzilla.redhat.com/show_bug.cgi?id=781648 trousers-tcsd-dos(80226) Multiple cross-site request forgery (CSRF) vulnerabilities in Family Connections CMS (aka FCMS) 2.9 and earlier allow remote attackers to hijack the authentication of arbitrary users for requests that (1) add news via an add action to familynews.php or (2) add a prayer via an add action to prayers.php. 18667 The client in InfoSphere FastTrack 8.1 through 8.7 in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 does not properly store credentials, which allows local users to bypass intended access restrictions via unspecified vectors. http://www-01.ibm.com/support/docview.wss?uid=swg21623501 infosphere-client-cred-storage(73266) The client applications in the DataStage Administrator client in InfoSphere DataStage in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 rely on client-side access control, which allows remote authenticated users to gain privileges via unspecified vectors. http://www-01.ibm.com/support/docview.wss?uid=swg21623501 infosphere-datastage-client-priv-esc(73285) Information Services Framework (ISF) in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 does not properly determine authorization, which allows remote authenticated users to gain privileges via unspecified vectors. Per: http://xforce.iss.net/xforce/xfdb/73287 "IBM InfoSphere Information Server could allow a remote authenticated attacker to gain elevated privileges due to insecure authentication controls." http://www-01.ibm.com/support/docview.wss?uid=swg21623501 infosphere-is-auth-priv-esc(73287) Open redirect vulnerability in Information Services Framework (ISF) in IBM InfoSphere Information Server 8.1, 8.5 before FP3, and 8.7 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. http://www-01.ibm.com/support/docview.wss?uid=swg21623501 infosphere-is-open-redirect(73289) InfoSphere Import Export Manager in InfoSphere Information Server MetaBrokers & Bridges (MBB) in IBM InfoSphere Information Server 8.1, 8.5 before FP3, 8.7, and 9.1 does not validate unspecified input data, which allows remote authenticated users to execute arbitrary commands via unknown vectors. http://www-01.ibm.com/support/docview.wss?uid=swg21623501 infosphere-iem-cmd-execution(73292) IBM Scale Out Network Attached Storage (SONAS) 1.3 before 1.3.2.3 requires cleartext storage of LDAP credentials without recommending a less privileged LDAP account, which might allow attackers to obtain sensitive server information by leveraging root access to a client machine. http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004292 sonas-ldap-cleartext(73309) Cross-site scripting (XSS) vulnerability in IBM WebSphere Lombardi Edition 7.2 allows remote attackers to inject arbitrary web script or HTML via crafted text input to a coach that is configured with a document attachment control section. IC79890 wle-coach-xss(73376) Heap-based buffer overflow in the Ole API in the CQOle ActiveX control in cqole.dll in IBM Rational ClearQuest 7.1.1 before 7.1.1.9, 7.1.2 before 7.1.2.6, and 8.0.0 before 8.0.0.2 allows remote attackers to execute arbitrary code via a crafted web page that leverages a RegisterSchemaRepoFromFileByDbSet function-prototype mismatch. 81443 48933 http://www.ibm.com/support/docview.wss?uid=swg21591705 53170 1026958 rcq-cqole-activex-bo(73492) IBM DB2 9.5 before FP9, 9.7 through FP5, and 9.8 through FP4 does not properly check variables, which allows remote authenticated users to bypass intended restrictions on viewing table data by leveraging the CREATEIN privilege to execute crafted SQL CREATE VARIABLE statements. IC81387 IC81390 IC81836 http://www-01.ibm.com/support/docview.wss?uid=swg21588100 db2-createvariable-security-bypass(73493) oval:org.mitre.oval:def:15004 IBM DB2 9.1 before FP11, 9.5 before FP9, 9.7 before FP5, and 9.8 before FP4 allows remote attackers to cause a denial of service (daemon crash) via a crafted Distributed Relational Database Architecture (DRDA) request. 78282 IC76781 IC76899 IC76901 IC76902 http://www-01.ibm.com/support/docview.wss?uid=swg21588090 db2-drda-dos(73494) oval:org.mitre.oval:def:15078 Integer signedness error in the db2dasrrm process in the DB2 Administration Server (DAS) in IBM DB2 9.1 through FP11, 9.5 before FP9, and 9.7 through FP5 on UNIX platforms allows remote attackers to execute arbitrary code via a crafted request that triggers a heap-based buffer overflow. 77826 IC80561 IC80728 IC80729 http://www-01.ibm.com/support/docview.wss?uid=swg21588093 db2-db2dasrrm-bo(73495) oval:org.mitre.oval:def:14842 The XML feature in IBM DB2 9.5 before FP9, 9.7 through FP5, and 9.8 through FP4 allows remote authenticated users to cause a denial of service (infinite loop) by calling the XMLPARSE function with a crafted string expression. IC81379 IC81380 IC81837 http://www-01.ibm.com/support/docview.wss?uid=swg21588098 db2-xmlfeature-dos(73496) oval:org.mitre.oval:def:14450 Unspecified vulnerability in the XML feature in IBM DB2 9.7 before FP6 on Linux, UNIX, and Windows allows remote authenticated users to read arbitrary XML files via unknown vectors. 53873 IC81462 Cross-site request forgery (CSRF) vulnerability in IBM Maximo Asset Management 6.2 through 7.5, as used in SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB), allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. IV16085 IV16497 http://www-01.ibm.com/support/docview.wss?uid=swg21610081 ibm-maximo-csrf(73534) Cross-site scripting (XSS) vulnerability in the Gantt applet viewer in IBM Tivoli Change and Configuration Management Database (CCMDB) 7.2.1 and IBM ILOG JViews Gantt allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://www-01.ibm.com/support/docview.wss?crawler=1&uid=swg1IV16174 IV16174 ijg-gav-xss(73587) Cross-site scripting (XSS) vulnerability in the Administration Console in IBM WebSphere Application Server 7.0 before 7.0.0.23 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://www.ibm.com/support/docview.wss?uid=swg21595172 52722 IBM WebSphere Application Server 7.0 before 7.0.0.23, when a certain SSLv2 configuration with client authentication is used, allows remote attackers to bypass X.509 client-certificate authentication via unspecified vectors. PM52351 http://www.ibm.com/support/docview.wss?uid=swg21595172 Cross-site scripting (XSS) vulnerability in IBM Tivoli Endpoint Manager (TEM) 8 before 8.2 patch 3 allows remote attackers to inject arbitrary web script or HTML via the ScheduleParam parameter to the webreports program. 52514 http://www-01.ibm.com/support/docview.wss?uid=swg21587743 tem-scheduleparam-xss(74039) Cross-site scripting (XSS) vulnerability in the Integration Solution Console in the Administration Console in IBM WebSphere Application Server 7.0 before 7.0.0.23 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. PM52274 http://www.ibm.com/support/docview.wss?uid=swg21595172 was-isc-xss(74044) ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2012. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-0722. Reason: This candidate is a duplicate of CVE-2013-0722. A year-transition issue caused the wrong ID to be used. Notes: All CVE users should reference CVE-2013-0722 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. The kernel in IBM AIX 5.3, 6.1, and 7.1, and VIOS 2.2.1.4-FP-25 SP-02, does not properly implement the dupmsg system call, which allows local users to cause a denial of service (system crash) via a crafted application. http://aix.software.ibm.com/aix/efixes/security/syscall_advisory.asc IV22693 IV22694 IV22695 IV22696 IV22697 1027315 aix-dupmsg-dos(74134) Adobe Flash Player before 11.2.202.229 in Google Chrome before 18.0.1025.151 allow attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2012-0725. http://googlechromereleases.blogspot.com/2012/04/stable-and-beta-channel-updates.html http://www.adobe.com/support/security/bulletins/apsb12-07.html http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf oval:org.mitre.oval:def:15533 Adobe Flash Player before 11.2.202.229 in Google Chrome before 18.0.1025.151 allow attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2012-0724. http://googlechromereleases.blogspot.com/2012/04/stable-and-beta-channel-updates.html http://www.adobe.com/support/security/bulletins/apsb12-07.html http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf oval:org.mitre.oval:def:14628 The default configuration of TLS in IBM Tivoli Directory Server (TDS) 6.3 and earlier supports the (1) NULL-MD5 and (2) NULL-SHA ciphers, which allows remote attackers to trigger unencrypted communication via the TLS Handshake Protocol. IO15761 IO16035 IO16036 53043 1026939 http://www-01.ibm.com/support/docview.wss?uid=swg21591272 tds-nullcipher-weak-security(74303) SQL injection vulnerability in IBM Maximo Asset Management 7.5, as used in SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB), allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. IV17963 http://www-01.ibm.com/support/docview.wss?uid=swg21610081 ibm-maximo-sql-injection-iv17963(74306) SQL injection vulnerability in IBM Maximo Asset Management 7.1 through 7.5, as used in SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB), allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. IV17964 http://www-01.ibm.com/support/docview.wss?uid=swg21610081 ibm-maximo-sql-injection-iv17964(74307) Unrestricted file upload vulnerability in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 allows remote authenticated users to execute arbitrary ASP.NET code by uploading a .aspx file, and then accessing it via unspecified vectors. Per: http://cwe.mitre.org/data/definitions/434.html 'Unrestricted Upload of File with Dangerous Type' http://www.ibm.com/support/docview.wss?uid=swg21592188 53247 appscan-file-upload(74366) Multiple cross-site request forgery (CSRF) vulnerabilities in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 allow remote attackers to hijack the authentication of administrators for requests that create administrative accounts. http://www.ibm.com/support/docview.wss?uid=swg21592188 53247 ae-multiple-csrf(74370) IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not prevent service-account impersonation, which allows remote authenticated users to read arbitrary files via unspecified vectors. http://www.ibm.com/support/docview.wss?uid=swg21592188 53247 ae-config-info-disclosure(74371) The Enterprise Console client in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. http://www.ibm.com/support/docview.wss?uid=swg21592188 53247 ae-ecc-spoofing(74389) IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1, when Integrated Windows authentication is used, allows remote authenticated users to obtain administrative privileges by hijacking a session associated with the service account. http://www.ibm.com/support/docview.wss?uid=swg21592188 53247 ae-serviceacct-session-hijacking(74374) IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not properly import jobs, which allows man-in-the-middle attackers to obtain sensitive information or possibly have unspecified other impact via a crafted job. http://www.ibm.com/support/docview.wss?uid=swg21592188 53247 ae-importjob-info-disclosure(74557) IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not properly scan file: URLs, which allows man-in-the-middle attackers to obtain sensitive information or possibly have unspecified other impact via a crafted URI. http://www.ibm.com/support/docview.wss?uid=swg21592188 53247 ae-fileuri-info-disclosure(74558) IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 does not properly create scan jobs, which allows remote attackers to execute arbitrary code via a crafted web site. http://www.ibm.com/support/docview.wss?uid=swg21592188 53247 ae-platformauth-code-execution(74559) Cross-site scripting (XSS) vulnerability in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. http://www.ibm.com/support/docview.wss?uid=swg21592188 53247 appscan-enterprise-xss(74560) IBM Security AppScan Enterprise before 8.6.0.2 and Rational Policy Tester before 8.5.0.3 do not validate X.509 certificates during scanning, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary certificate. http://www-01.ibm.com/support/docview.wss?uid=swg21620759 http://www-01.ibm.com/support/docview.wss?uid=swg21620760 appscan-scan-spoofing(74578) Cross-site scripting (XSS) vulnerability in the Web Admin Tool in IBM Tivoli Directory Server (TDS) 6.2 before 6.2.0.22 and 6.3 before 6.3.0.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IO14508 IO16016 1026880 http://www-01.ibm.com/support/docview.wss?uid=swg24032290 http://www-01.ibm.com/support/docview.wss?uid=swg24032291 tds-wat-xss(74610) IBM Security AppScan Enterprise before 8.6.0.2 and Rational Policy Tester before 8.5.0.3 do not validate X.509 certificates during use of the Manual Explore Proxy feature, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary certificate. http://www-01.ibm.com/support/docview.wss?uid=swg21620759 http://www-01.ibm.com/support/docview.wss?uid=swg21620760 appscan-mep-spoofing(74142) IBM Tivoli Event Pump 4.2.2, when the LOG_REQUESTS and VALIDATE_SOAP_USERS options are enabled, places credentials into the AOPSCLOG (aka AOPLOG) data set, which allows local users to obtain sensitive information by reading the data. OA38586 tep-aopsclog-info-disclosure(74641) IBM Tivoli Directory Server (TDS) 6.3 and earlier allows remote attackers to cause a denial of service (daemon crash) via a malformed LDAP paged search request. IO15707 IO16001 IO16002 53043 1026938 http://www-01.ibm.com/support/docview.wss?uid=swg21591267 IBM Rational ClearQuest 7.1.x through 7.1.2.7 and 8.x through 8.0.0.3 allows remote attackers to obtain potentially sensitive information via a request to a (1) snoop, (2) hello, (3) ivt/, (4) hitcount, (5) HitCount.jsp, (6) HelloHTMLError.jsp, (7) HelloHTML.jsp, (8) HelloVXMLError.jsp, (9) HelloVXML.jsp, (10) HelloWMLError.jsp, (11) HelloWML.jsp, or (12) cqweb/j_security_check sample script. http://www.ibm.com/support/docview.wss?uid=swg21599361 http://www.ibm.com/support/docview.wss?uid=swg21606317 PM66896 rcq-installscripts-info-disclosure(74671) The getpwnam function in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.1.0.10 through 2.2.1.3 does not properly interact with customer-extended LDAP user filtering, which allows local users to gain privileges via unspecified vectors. http://aix.software.ibm.com/aix/efixes/security/ldapauth_advisory2.asc 49073 IV18464 IV18637 IV18638 IV19077 IV19097 IV19098 53393 1027021 aix-getpwnam-privilege-escalation(74679) Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5, as used in SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB), allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. IV17961 http://www-01.ibm.com/support/docview.wss?uid=swg21610081 ibm-maximo-xss-iv17961(74726) SQL injection vulnerability in IBM Maximo Asset Management 6.2 through 7.5, as used in SmartCloud Control Desk, Tivoli Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB), allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors. IV16032 http://www-01.ibm.com/support/docview.wss?uid=swg21610081 ibm-maximo-sql-injection-iv16032(74731) Multiple cross-site request forgery (CSRF) vulnerabilities in unspecified services in IBM Rational Team Concert (RTC) 4.x before 4.0.0.1 allow remote attackers to hijack the authentication of arbitrary users for requests that modify work items. 55730 http://www-01.ibm.com/support/docview.wss?uid=swg21612356 rtc-services-csrf(74736) The ActiveX control in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. openSUSE-SU-2012:0265 48265 http://www.adobe.com/support/security/bulletins/apsb12-03.html oval:org.mitre.oval:def:14985 Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows attackers to execute arbitrary code or cause a denial of service (memory corruption) by leveraging an unspecified "type confusion." openSUSE-SU-2012:0265 RHSA-2012:0144 48265 GLSA-201204-07 http://www.adobe.com/support/security/bulletins/apsb12-03.html oval:org.mitre.oval:def:14654 oval:org.mitre.oval:def:16103 Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted MP4 data. openSUSE-SU-2012:0265 RHSA-2012:0144 48265 GLSA-201204-07 http://www.adobe.com/support/security/bulletins/apsb12-03.html oval:org.mitre.oval:def:14795 oval:org.mitre.oval:def:15601 Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. openSUSE-SU-2012:0265 RHSA-2012:0144 48265 GLSA-201204-07 http://www.adobe.com/support/security/bulletins/apsb12-03.html oval:org.mitre.oval:def:15030 oval:org.mitre.oval:def:15973 Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2012-0756. openSUSE-SU-2012:0265 RHSA-2012:0144 48265 GLSA-201204-07 http://www.adobe.com/support/security/bulletins/apsb12-03.html oval:org.mitre.oval:def:14731 oval:org.mitre.oval:def:15899 Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2012-0755. openSUSE-SU-2012:0265 RHSA-2012:0144 48265 GLSA-201204-07 http://www.adobe.com/support/security/bulletins/apsb12-03.html oval:org.mitre.oval:def:14881 oval:org.mitre.oval:def:16149 The Shockwave 3D Asset component in Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0760, CVE-2012-0761, CVE-2012-0762, CVE-2012-0763, CVE-2012-0764, and CVE-2012-0766. http://www.adobe.com/support/security/bulletins/apsb12-02.html Heap-based buffer overflow in Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code via unspecified vectors. http://www.adobe.com/support/security/bulletins/apsb12-02.html Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0771. http://www.adobe.com/support/security/bulletins/apsb12-02.html The Shockwave 3D Asset component in Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0757, CVE-2012-0761, CVE-2012-0762, CVE-2012-0763, CVE-2012-0764, and CVE-2012-0766. http://www.adobe.com/support/security/bulletins/apsb12-02.html The Shockwave 3D Asset component in Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0757, CVE-2012-0760, CVE-2012-0762, CVE-2012-0763, CVE-2012-0764, and CVE-2012-0766. http://www.adobe.com/support/security/bulletins/apsb12-02.html 52001 adobe-shockwave-3d-code-exec(73174) The Shockwave 3D Asset component in Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0757, CVE-2012-0760, CVE-2012-0761, CVE-2012-0763, CVE-2012-0764, and CVE-2012-0766. http://www.adobe.com/support/security/bulletins/apsb12-02.html 52002 shockwave-3d-code-exec(73175) The Shockwave 3D Asset component in Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0757, CVE-2012-0760, CVE-2012-0761, CVE-2012-0762, CVE-2012-0764, and CVE-2012-0766. http://www.adobe.com/support/security/bulletins/apsb12-02.html The Shockwave 3D Asset component in Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0757, CVE-2012-0760, CVE-2012-0761, CVE-2012-0762, CVE-2012-0763, and CVE-2012-0766. http://www.adobe.com/support/security/bulletins/apsb12-02.html 52004 Multiple cross-site scripting (XSS) vulnerabilities in Adobe RoboHelp 8 and 9 for Word allow remote attackers to inject arbitrary web script or HTML via a crafted URL, related to certain .htm files in (1) template_stock and (2) template_csh directories. http://www.adobe.com/support/security/bulletins/apsb12-04.html 52008 1026676 adobe-robohelp-output-xss(73179) The Shockwave 3D Asset component in Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0757, CVE-2012-0760, CVE-2012-0761, CVE-2012-0762, CVE-2012-0763, and CVE-2012-0764. http://www.adobe.com/support/security/bulletins/apsb12-02.html Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)," as exploited in the wild in February 2012. openSUSE-SU-2012:0265 RHSA-2012:0144 48265 GLSA-201204-07 http://www.adobe.com/support/security/bulletins/apsb12-03.html oval:org.mitre.oval:def:14806 oval:org.mitre.oval:def:15933 The Matrix3D component in Adobe Flash Player before 10.3.183.16 and 11.x before 11.1.102.63 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.7 on Android 2.x and 3.x; and before 11.1.115.7 on Android 4.x allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. openSUSE-SU-2012:0331 SUSE-SU-2012:0332 GLSA-201204-07 http://www.adobe.com/support/security/bulletins/apsb12-05.html http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf oval:org.mitre.oval:def:15058 oval:org.mitre.oval:def:15922 Adobe Flash Player before 10.3.183.16 and 11.x before 11.1.102.63 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.7 on Android 2.x and 3.x; and before 11.1.115.7 on Android 4.x does not properly handle integers, which allows attackers to obtain sensitive information via unspecified vectors. openSUSE-SU-2012:0331 SUSE-SU-2012:0332 GLSA-201204-07 http://www.adobe.com/support/security/bulletins/apsb12-05.html http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf oval:org.mitre.oval:def:14828 oval:org.mitre.oval:def:16212 Adobe ColdFusion 8.0, 8.0.1, 9.0, and 9.0.1 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. Per: http://cwe.mitre.org/data/definitions/407.html 'CWE-407: Algorithmic Complexity' http://helpx.adobe.com/coldfusion/kb/coldfusion-security-hotfix.html 80008 48393 http://www.adobe.com/support/security/bulletins/apsb12-06.html 1026830 adobe-coldfusion-hash-dos(73955) Adobe Shockwave Player before 11.6.4.634 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-0759. https://fortiguard.com/encyclopedia/ips/31101/adobe-shockwave-player-multiple-memory-corruption https://www.adobe.com/support/security/bulletins/apsb12-02.html An unspecified ActiveX control in Adobe Flash Player before 10.3.183.18 and 11.x before 11.2.202.228, and AIR before 3.2.0.2070, on Windows does not properly perform URL security domain checking, which allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors. http://www.adobe.com/support/security/bulletins/apsb12-07.html 1026859 http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf oval:org.mitre.oval:def:15266 The NetStream class in Adobe Flash Player before 10.3.183.18 and 11.x before 11.2.202.228 on Windows, Mac OS X, and Linux; Flash Player before 10.3.183.18 and 11.x before 11.2.202.223 on Solaris; Flash Player before 11.1.111.8 on Android 2.x and 3.x; and AIR before 3.2.0.2070 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. openSUSE-SU-2012:0427 SUSE-SU-2012:0437 48652 GLSA-201204-07 http://www.adobe.com/support/security/bulletins/apsb12-07.html 1026859 http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf oval:org.mitre.oval:def:15391 oval:org.mitre.oval:def:16157 Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to execute arbitrary code via a crafted TrueType font. openSUSE-SU-2012:0512 SUSE-SU-2012:0522 SUSE-SU-2012:0524 RHSA-2012:0469 http://www.adobe.com/support/security/bulletins/apsb12-08.html 52951 1026908 TA12-101B oval:org.mitre.oval:def:14860 The JavaScript implementation in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. openSUSE-SU-2012:0512 SUSE-SU-2012:0522 SUSE-SU-2012:0524 RHSA-2012:0469 http://www.adobe.com/support/security/bulletins/apsb12-08.html 52949 1026908 TA12-101B adobe-reader-javascript-code-exec(74733) oval:org.mitre.oval:def:15477 The installer in Adobe Reader 9.x before 9.5.1 and 10.x before 10.1.3 allows attackers to bypass intended access restrictions and execute arbitrary code via unspecified vectors. http://www.adobe.com/support/security/bulletins/apsb12-08.html 1026908 TA12-101B oval:org.mitre.oval:def:15270 The JavaScript API in Adobe Reader and Acrobat 9.x before 9.5.1 and 10.x before 10.1.3 on Mac OS X and Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors. Per: http://www.adobe.com/support/security/bulletins/apsb12-08.html 'These updates resolve a memory corruption in the JavaScript API that could lead to code execution (CVE-2012-0777) (Macintosh and Linux only).' openSUSE-SU-2012:0512 SUSE-SU-2012:0522 SUSE-SU-2012:0524 RHSA-2012:0469 http://www.adobe.com/support/security/bulletins/apsb12-08.html 52950 1026908 TA12-101B adobe-reader-javascriptapi-code-exec(74735) Buffer overflow in Adobe Flash Professional before CS6 allows attackers to execute arbitrary code via unspecified vectors. http://www.adobe.com/support/security/bulletins/apsb12-12.html 53419 1027045 Adobe Flash Player before 10.3.183.19 and 11.x before 11.2.202.235 on Windows, Mac OS X, and Linux; before 11.1.111.9 on Android 2.x and 3.x; and before 11.1.115.8 on Android 4.x allows remote attackers to execute arbitrary code via a crafted file, related to an "object confusion vulnerability," as exploited in the wild in May 2012. SUSE-SU-2012:0592 openSUSE-SU-2012:0594 RHSA-2012:0688 http://www.adobe.com/support/security/bulletins/apsb12-09.html 53395 1027023 adobe-flash-objecttype-code-exec(75383) Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2023, CVE-2012-2024, CVE-2012-2025, and CVE-2012-2026. http://www.adobe.com/support/security/bulletins/apsb12-10.html 53422 1027047 illustrator-unspec-code-exec(75445) The tidy_diagnose function in PHP 5.3.8 might allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via crafted input to an application that attempts to perform Tidy::diagnose operations on invalid objects, a different vulnerability than CVE-2011-4153. 20120114 PHP 5.3.8 Multiple vulnerabilities http://cxsecurity.com/research/103 SUSE-SU-2012:0411 openSUSE-SU-2012:0426 18370 ** DISPUTED ** Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) dbhost, (2) dbname, or (3) uname parameter. NOTE: the vendor disputes the significance of this issue; also, it is unclear whether this specific XSS scenario has security relevance. 20120124 TWSL2012-002: Multiple Vulnerabilities in WordPress 18417 https://www.trustwave.com/spiderlabs/advisories/TWSL2012-002.txt The transform_save function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on a .augnew file. http://augeas.net/news.html RHSA-2013:1537 https://bugzilla.redhat.com/show_bug.cgi?id=772257 https://github.com/hercules-team/augeas/commit/16387744 The clone_file function in transfer.c in Augeas before 1.0.0, when copy_if_rename_fails is set and EXDEV or EBUSY is returned by the rename function, allows local users to overwrite arbitrary files and obtain sensitive information via a bind mount on the (1) .augsave or (2) destination file when using the backup save option, or (3) .augnew file when using the newfile save option. http://augeas.net/news.html RHSA-2013:1537 https://bugzilla.redhat.com/show_bug.cgi?id=772261 https://github.com/hercules-team/augeas/commit/b8de6a8c The PDORow implementation in PHP before 5.3.9 does not properly interact with the session feature, which allows remote attackers to cause a denial of service (application crash) via a crafted application that uses a PDO driver for a fetch and then calls the session_start function, as demonstrated by a crash of the Apache HTTP Server. SUSE-SU-2012:0411 openSUSE-SU-2012:0426 http://www.php.net/ChangeLog-5.php#5.3.9 https://bugs.php.net/bug.php?id=55776 https://bugzilla.redhat.com/show_bug.cgi?id=783605 Memory leak in the timezone functionality in PHP before 5.3.9 allows remote attackers to cause a denial of service (memory consumption) by triggering many strtotime function calls, which are not properly handled by the php_date_parse_tzfile cache. SUSE-SU-2012:0411 openSUSE-SU-2012:0426 http://www.php.net/ChangeLog-5.php#5.3.9 https://bugs.php.net/bug.php?id=53502 https://bugzilla.redhat.com/show_bug.cgi?id=783609 Cross-site scripting (XSS) vulnerability in smokeping_cgi in Smokeping 2.4.2, 2.6.6, and other versions before 2.6.7 allows remote attackers to inject arbitrary web script or HTML via the displaymode parameter. http://holisticinfosec.org/content/view/188/45/ http://oss.oetiker.ch/smokeping/pub/CHANGES [oss-security] 20120120 Re: CVE request: smokeping XSS 51584 https://bugs.gentoo.org/show_bug.cgi?id=399553 https://bugzilla.redhat.com/show_bug.cgi?id=783584 Multiple cross-site scripting (XSS) vulnerabilities in Horde IMP before 5.0.18 and Horde Groupware Webmail Edition before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) composeCache, (2) rtemode, or (3) filename_* parameters to the compose page; (4) formname parameter to the contacts popup window; or (5) IMAP mailbox names. NOTE: some of these details are obtained from third party information. DSA-2485 http://www.horde.org/apps/imp/docs/CHANGES http://www.horde.org/apps/imp/docs/RELEASE_NOTES http://www.horde.org/apps/webmail/docs/CHANGES http://www.horde.org/apps/webmail/docs/RELEASE_NOTES [oss-security] 20120121 Re: Re: CVE Request -- Horde IMP -- Multiple XSS flaws 51586 1026553 1026554 mod/forum/user.php in Moodle 1.9.x before 1.9.16 allows remote authenticated users to obtain the names and other details of arbitrary user accounts by searching for posts. http://git.moodle.org/gw?p=moodle.git;a=commit;h=36b0ddeed45d0751508dcd9fa50f17fda43bae54 http://moodle.org/mod/forum/discuss.php?d=194009 DSA-2421 https://bugzilla.redhat.com/show_bug.cgi?id=783532 Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 allows remote attackers to view the profile images of arbitrary user accounts via unspecified vectors. http://git.moodle.org/gw?p=moodle.git;a=commit;h=90911c4ff98dc2078a3acef5ddf5a1a8f7e20ba5 http://moodle.org/mod/forum/discuss.php?d=194012 DSA-2421 https://bugzilla.redhat.com/show_bug.cgi?id=783532 The rc4encrypt function in lib/moodlelib.php in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 uses a hardcoded password of nfgjeingjk, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by reading this script's source code within the open-source software distribution. http://git.moodle.org/gw?p=moodle.git;a=commit;h=98456628a24bba25d336860d38a45b5a4e3895da http://moodle.org/mod/forum/discuss.php?d=194013 DSA-2421 https://bugzilla.redhat.com/show_bug.cgi?id=783532 Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 does not validate e-mail address settings, which allows remote authenticated users to have an unspecified impact via a crafted address. http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-13572 http://moodle.org/mod/forum/discuss.php?d=194014 DSA-2421 https://bugzilla.redhat.com/show_bug.cgi?id=783532 class.phpmailer.php in the PHPMailer library, as used in Moodle 1.9.x before 1.9.16, 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 and other products, allows remote authenticated users to inject arbitrary e-mail headers via vectors involving a crafted (1) From: or (2) Sender: header. http://git.moodle.org/gw?p=moodle.git;a=commit;h=62988bf0bbc73df655f51884aaf1f523928abff9 http://moodle.org/mod/forum/discuss.php?d=194015 DSA-2421 https://bugzilla.redhat.com/show_bug.cgi?id=783532 The webservices functionality in Moodle 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 allows remote authenticated users to bypass the deleted status and continue using a server via a token. http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-28126 http://moodle.org/mod/forum/discuss.php?d=194016 https://bugzilla.redhat.com/show_bug.cgi?id=783532 The self-enrolment functionality in Moodle 2.1.x before 2.1.4 and 2.2.x before 2.2.1 allows remote authenticated users to obtain the manager role by leveraging the teacher role. http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-29469 http://moodle.org/mod/forum/discuss.php?d=194017 https://bugzilla.redhat.com/show_bug.cgi?id=783532 Moodle 2.0.x before 2.0.7 and 2.1.x before 2.1.4, when an anonymous front-page forum is enabled, allows remote attackers to obtain session keys for their sessions by visiting the front page. http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-27334 http://moodle.org/mod/forum/discuss.php?d=194018 https://bugzilla.redhat.com/show_bug.cgi?id=783532 The form-autocompletion functionality in Moodle 2.0.x before 2.0.7, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 makes it easier for physically proximate attackers to discover passwords by reading the contents of a non-password field, as demonstrated by accessing a create-groups page with Safari on an iPad device. http://git.moodle.org/gw?p=moodle.git;a=commit;h=6e9989dbd3f261b2e1586ff77b0bf22fc7091485 http://moodle.org/mod/forum/discuss.php?d=194019 https://bugzilla.redhat.com/show_bug.cgi?id=783532 lib/formslib.php in Moodle 2.1.x before 2.1.4 and 2.2.x before 2.2.1 does not properly handle multiple instances of a form element, which has unspecified impact and remote attack vectors. http://git.moodle.org/gw?p=moodle.git;a=commit;h=51070abc78b9e1db1db9a44855e8623b22bebd48 http://moodle.org/mod/forum/discuss.php?d=194020 https://bugzilla.redhat.com/show_bug.cgi?id=783532 Multiple buffer overflows in Spamdyke before 4.3.0 might allow remote attackers to execute arbitrary code via vectors related to "serious errors in the usage of snprintf()/vsnprintf()" in which the return values may be larger than the size of the buffer. GLSA-201203-01 [spamdyke-release] 20120115 New version: spamdyke 4.3.0 [oss-security] 20120123 Re: CVE request: spamdyke buffer overflow vulnerability 51440 http://www.spamdyke.org/documentation/Changelog.txt The WS-SP UsernameToken policy in Apache CXF 2.4.5 and 2.5.1 allows remote attackers to bypass authentication by sending an empty UsernameToken as part of a SOAP request. [Full-disclosure] 20120207 Apache CXF does not validate UsernameToken policies correctly http://svn.apache.org/viewvc?view=revision&revision=1233457 Heap-based buffer overflow in the proxy_connect function in src/client.c in CVS 1.11 and 1.12 allows remote HTTP proxy servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted HTTP response. openSUSE-SU-2012:0310 RHSA-2012:0321 USN-1371-1 DSA-2407 MDVSA-2012:044 51943 1026719 https://bugzilla.redhat.com/show_bug.cgi?id=784141 cvs-proxyconnect-bo(73097) GLSA-201701-44 Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function. RHSA-2012:0369 DSA-2449 MDVSA-2012:059 http://www.sqlalchemy.org/changelog/CHANGES_0_7_0 http://www.sqlalchemy.org/trac/changeset/852b6a1a87e7/ https://bugs.launchpad.net/keystone/+bug/918608 sqlalchemy-select-sql-injection(73756) Buffer overflow in Bip 0.8.8 and earlier might allow remote authenticated users to execute arbitrary code via vectors involving a series of TCP connections that triggers use of many open file descriptors. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=657217 FEDORA-2012-0941 FEDORA-2012-0916 [oss-security] 20120124 Re: CVE request: bip buffer overflow [oss-security] 20120124 CVE request: bip buffer overflow MDVSA-2013:063 https://projects.duckcorp.org/issues/269 https://projects.duckcorp.org/projects/bip/repository/revisions/222a33cb84a2e52ad55a88900b7895bf9dd0262c Stack-based buffer overflow in the suhosin_encrypt_single_cookie function in the transparent cookie-encryption feature in the Suhosin extension before 0.9.33 for PHP, when suhosin.cookie.encrypt and suhosin.multiheader are enabled, might allow remote attackers to execute arbitrary code via a long string that is used in a Set-Cookie HTTP header. 20120119 Advisory 01/2012: Suhosin PHP Extension Transparent Cookie Encryption Stack Buffer Overflow SUSE-SU-2012:0411 openSUSE-SU-2012:0426 SUSE-SU-2012:0472 [oss-security] 20120124 Re: CVE requests: Suhosin extension / as31 [oss-security] 20120124 CVE requests: Suhosin extension / as31 https://bugzilla.redhat.com/show_bug.cgi?id=783350 https://github.com/stefanesser/suhosin/commit/73b1968ee30f6d9d2dae497544b910e68e114bfa as31 2.3.1-4 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=655496 [oss-security] 20120124 Re: CVE requests: Suhosin extension / as31 [oss-security] 20120124 CVE requests: Suhosin extension / as31 [oss-security] 20120705 Three CVE requests: at-spi2-atk, as31, naxsi [oss-security] 20120706 Re: Three CVE requests: at-spi2-atk, as31, naxsi [oss-security] 20120831 Re: Three CVE requests: at-spi2-atk, as31, naxsi Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbitrary code via format string sequences in the program name for sudo. 20120130 Advisory: sudo 1.8 Format String Vulnerability http://archives.neohapsis.com/archives/fulldisclosure/2012-01/att-0591/advisory_sudo.txt GLSA-201203-06 http://www.sudo.ws/sudo/alerts/sudo_debug.html Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2) unspecified vectors that are used in backup files generated by backup.php. http://www.codseq.it/advisories/multiple_vulnerabilities_in_postfixadmin [oss-security] 20120126 CVE request: PostfixAdmin SQL injections and XSS [oss-security] 20120127 Re: CVE request: PostfixAdmin SQL injections and XSS 51680 https://svn.code.sf.net/p/postfixadmin/code/branches/postfixadmin-2.3/CHANGELOG.TXT Wicd before 1.7.1 saves sensitive information in log files in /var/log/wicd, which allows context-dependent attackers to obtain passwords and other sensitive information. http://bazaar.launchpad.net/~wicd-devel/wicd/experimental/revision/682 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=652417 GLSA-201206-08 [oss-security] 20120126 CVE request: wicd writes sensitive information in log files (password, passphrase...) [oss-security] 20120126 Re: CVE request: wicd writes sensitive information in log files (password, passphrase...) 51703 https://launchpad.net/wicd/+announcement/9570 The auth_parse_options function in auth-options.c in sshd in OpenSSH before 5.7 provides debug messages containing authorized_keys command options, which allows remote authenticated users to obtain potentially sensitive information by reading these messages, as demonstrated by the shared user account required by Gitolite. NOTE: this can cross privilege boundaries because a user account may intentionally have no shell or filesystem access, and therefore may have no supported way to read an authorized_keys file in its own home directory. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=657445 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10673 [oss-security] 20120126 CVE Request: Debian (others?) openssh-server: Forced Command handling leaks private information to ssh clients [oss-security] 20120126 Re: CVE Request: Debian (others?) openssh-server: Forced Command handling leaks private information to ssh clients [oss-security] 20120126 Re: CVE Request: Debian (others?) openssh-server: Forced Command handling leaks private information to ssh clients [oss-security] 20120127 Re: CVE Request: Debian (others?) openssh-server: Forced Command handling leaks private information to ssh clients http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth-options.c http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/auth-options.c.diff?r1=1.53;r2=1.54 51702 opensshserver-commands-info-disc(72756) The headerVerifyInfo function in lib/header.c in RPM before 4.9.1.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a negative value in a region offset of a package header, which is not properly handled in a numeric range comparison. FEDORA-2012-5298 FEDORA-2012-5420 FEDORA-2012-5421 RHSA-2012:0451 RHSA-2012:0531 http://rpm.org/gitweb?p=rpm.git;a=commitdiff;h=472e569562d4c90d7a298080e0052856aa7fa86b http://rpm.org/gitweb?p=rpm.git;a=commitdiff;h=858a328cd0f7d4bcd8500c78faaf00e4f8033df6 http://rpm.org/wiki/Releases/4.9.1.3 MDVSA-2012:056 http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html 52865 1026882 USN-1695-1 https://bugzilla.redhat.com/show_bug.cgi?id=744104 rpm-headerverifyinfo-code-execution(74581) openSUSE-SU-2012:0588 openSUSE-SU-2012:0589 Memory leak in smbd in Samba 3.6.x before 3.6.3 allows remote attackers to cause a denial of service (memory and CPU consumption) by making many connection requests. FEDORA-2012-1098 SUSE-SU-2012:0502 SUSE-SU-2012:0515 http://www.samba.org/samba/history/samba-3.6.3.html http://www.samba.org/samba/security/CVE-2012-0817 RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack. RHSA-2012:0441 RHSA-2012:0519 RHSA-2012:1056 RHSA-2012:1057 RHSA-2012:1058 RHSA-2012:1059 RHSA-2012:1125 RHSA-2014:0371 RHSA-2014:0372 51748 51766 https://bugzilla.redhat.com/show_bug.cgi?id=785631 resteasy-xml-info-disclosure(72808) https://issues.jboss.org/browse/RESTEASY-637 Unspecified vulnerability in Joomla! 1.6.x and 1.7.x before 1.7.4 allows remote attackers to obtain sensitive information via unknown vectors, a different vulnerability than CVE-2012-0821. http://developer.joomla.org/security/news/382-20120101-core-information-disclosure http://www.joomla.org/announcements/release-news/5403-joomla-250-released.html http://www.joomla.org/announcements/release-news/5405-joomla-174-released.html [oss-security] 20120125 Fwd Joomla! Security News 2012-01 [oss-security] 20120125 Re: Fwd Joomla! Security News 2012-01 [oss-security] 20120126 Re: Fwd Joomla! Security News 2012-01 [oss-security] 20120129 Re: Fwd Joomla! Security News 2012-01 Cross-site scripting (XSS) vulnerability in Joomla! 1.6.x and 1.7.x before 1.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0822. http://developer.joomla.org/security/news/383-20120102-core-xss-vulnerability http://www.joomla.org/announcements/release-news/5403-joomla-250-released.html http://www.joomla.org/announcements/release-news/5405-joomla-174-released.html [oss-security] 20120125 Fwd Joomla! Security News 2012-01 [oss-security] 20120125 Re: Fwd Joomla! Security News 2012-01 [oss-security] 20120126 Re: Fwd Joomla! Security News 2012-01 [oss-security] 20120129 Re: Fwd Joomla! Security News 2012-01 Unspecified vulnerability in Joomla! 1.6.x and 1.7.x before 1.7.4 allows remote attackers to obtain sensitive information via unknown vectors, a different vulnerability than CVE-2012-0819. http://developer.joomla.org/security/news/384-20120103-core-information-disclosure http://www.joomla.org/announcements/release-news/5403-joomla-250-released.html http://www.joomla.org/announcements/release-news/5405-joomla-174-released.html [oss-security] 20120125 Fwd Joomla! Security News 2012-01 [oss-security] 20120125 Re: Fwd Joomla! Security News 2012-01 [oss-security] 20120126 Re: Fwd Joomla! Security News 2012-01 [oss-security] 20120129 Re: Fwd Joomla! Security News 2012-01 Cross-site scripting (XSS) vulnerability in Joomla! 1.6 and 1.7.x before 1.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0820. http://developer.joomla.org/security/news/385-20120104-core-xss-vulnerability http://www.joomla.org/announcements/release-news/5403-joomla-250-released.html http://www.joomla.org/announcements/release-news/5405-joomla-174-released.html [oss-security] 20120125 Fwd Joomla! Security News 2012-01 [oss-security] 20120125 Re: Fwd Joomla! Security News 2012-01 [oss-security] 20120126 Re: Fwd Joomla! Security News 2012-01 [oss-security] 20120129 Re: Fwd Joomla! Security News 2012-01 VP8 Codec SDK (libvpx) before 1.0.0 "Duclair" allows remote attackers to cause a denial of service (application crash) via (1) unspecified "corrupt input" or (2) by "starting decoding from a P-frame," which triggers an out-of-bounds read, related to "the clamping of motion vectors in SPLITMV blocks". http://blog.webmproject.org/2012/01/vp8-codec-sdk-duclair-released.html http://code.google.com/p/webm/source/browse/CHANGELOG?repo=libvpx MDVSA-2012:023 [oss-security] 20120128 (maybe) CVE request: libvpx before 1.0 crasher [oss-security] 20120129 Re: (maybe) CVE request: libvpx before 1.0 crasher 51775 Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack. http://openid.net/2011/05/05/attribute-exchange-security-alert/ DSA-2776 https://drupal.org/node/1425084 Cross-site request forgery (CSRF) vulnerability in the Aggregator module in Drupal 6.x before 6.23 and 7.x before 7.11 allows remote attackers to hijack the authentication of unspecified victims for requests that update feeds and possibly cause a denial of service (loss of updates due to rate limit) via unspecified vectors. DSA-2776 https://drupal.org/node/1425084 The File module in Drupal 7.x before 7.11, when using unspecified field access modules, allows remote authenticated users to read arbitrary private files that are associated with restricted fields via unspecified vectors. https://drupal.org/node/1425084 Multiple cross-site request forgery (CSRF) vulnerabilities in Mibew Messenger 1.6.4 and earlier allow remote attackers to hijack the authentication of operators for requests that insert cross-site scripting (XSS) sequences via the (1) address or (2) threadid parameters to operator/ban.php; or (3) geolinkparams, (4) title, or (5) chattitle parameters to operator/settings.php. 20120130 Mibew messenger multiple XSS http://www.codseq.it/advisories/mibew_messenger_multiple_xss [oss-security] 20120202 Re: XSS hiding CSRF (was: Re: Mibew messenger multiple XSS) 51723 mibew-webinterface-csrf(72822) The php_register_variable_ex function in php_variables.c in PHP 5.3.9 allows remote attackers to execute arbitrary code via a request containing a large number of variables, related to improper handling of array variables. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4885. HPSBMU02786 APPLE-SA-2012-05-09-1 SUSE-SU-2012:0411 openSUSE-SU-2012:0426 SSRT100856 [oss-security] 20120202 PHP remote code execution introduced via HashDoS fix [oss-security] 20120203 Re: PHP remote code execution introduced via HashDoS fix RHSA-2012:0092 1026631 http://support.apple.com/kb/HT5281 http://svn.php.net/viewvc?view=revision&revision=323007 http://thexploit.com/sec/critical-php-remote-vulnerability-introduced-in-fix-for-php-hashtable-collision-dos/ DSA-2403 http://www.h-online.com/security/news/item/Critical-PHP-vulnerability-being-fixed-1427316.html http://www.php.net/ChangeLog-5.php#5.3.10 51830 php-phpregistervariableex-code-exec(72911) https://gist.github.com/1725489 PHP before 5.3.10 does not properly perform a temporary change to the magic_quotes_gpc directive during the importing of environment variables, which makes it easier for remote attackers to conduct SQL injection attacks via a crafted request, related to main/php_variables.c, sapi/cgi/cgi_main.c, and sapi/fpm/fpm/fpm_main.c. As per: http://grokbase.com/t/php/php-internals/122ehfap93/about-cve-2012-0831-magic-quotes-gpc-remote-disable-vulnerability Version 5.3.10 and 5.3.11 are also vulnerable. APPLE-SA-2012-09-19-2 FEDORA-2012-6911 FEDORA-2012-6907 SUSE-SU-2012:0411 openSUSE-SU-2012:0426 SUSE-SU-2012:0472 RHSA-2013:1307 http://support.apple.com/kb/HT5501 http://svn.php.net/viewvc?view=revision&revision=323016 51954 USN-1358-1 php-magicquotesgpc-sec-bypass(73125) https://launchpadlibrarian.net/92454212/php5_5.3.2-1ubuntu4.13.diff.gz The acllas__handle_group_entry function in servers/plugins/acl/acllas.c in 389 Directory Server before 1.2.10 does not properly handled access control instructions (ACIs) that use certificate groups, which allows remote authenticated LDAP users with a certificate group to cause a denial of service (infinite loop and CPU consumption) by binding to the server. RHSA-2012:0813 https://fedorahosted.org/389/changeset/1bbbb3e5049c1aa0650546efab87ed2f1ea59637/389-ds-base https://fedorahosted.org/389/ticket/162 Cross-site scripting (XSS) vulnerability in lib/QueryRender.php in phpLDAPadmin 1.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the base parameter in a query_engine action to cmd.php. [oss-security] 20120202 CVE request: phpldapadmin "base" Cross-Site Scripting Vulnerability [oss-security] 20120203 Re: CVE request: phpldapadmin "base" Cross-Site Scripting Vulnerability http://phpldapadmin.git.sourceforge.net/git/gitweb.cgi?p=phpldapadmin/phpldapadmin;a=commit;h=7dc8d57d6952fe681cb9e8818df7f103220457bd MDVSA-2012:020 https://sourceforge.net/tracker/index.php?func=detail&aid=3477910&group_id=61828&atid=498546 Unspecified vulnerability in Joomla! 1.7.x before 1.7.5 and 2.5.x before 2.5.1 allows attackers to obtain sensitive information via unknown vectors related to "administrator." http://developer.joomla.org/security/news/387-20120201-core-information-disclosure http://www.joomla.org/announcements/release-news/5410-joomla-251-released.html http://www.joomla.org/announcements/release-news/5411-joomla-175-released.html [oss-security] 20120203 CVE-request: Joomla! Security News 2012-02-03 [oss-security] 20120203 Re: CVE-request: Joomla! Security News 2012-02-03 Unspecified vulnerability in Joomla! 1.7.x before 1.7.5 allows attackers to read the error log via unknown vectors. http://developer.joomla.org/security/news/388-20120201-core-information-disclosure http://www.joomla.org/announcements/release-news/5411-joomla-175-released.html [oss-security] 20120203 CVE-request: Joomla! Security News 2012-02-03 [oss-security] 20120203 Re: CVE-request: Joomla! Security News 2012-02-03 Joomla! 1.7.x before 1.7.5 and 2.5.x before 2.5.1 allows attackers to obtain the installation path via unspecified vectors related to "administrator." http://developer.joomla.org/security/news/389-20120201-core-information-disclosure http://www.joomla.org/announcements/release-news/5410-joomla-251-released.html http://www.joomla.org/announcements/release-news/5411-joomla-175-released.html [oss-security] 20120203 CVE-request: Joomla! Security News 2012-02-03 [oss-security] 20120203 Re: CVE-request: Joomla! Security News 2012-02-03 Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field. JVN#79099262 JVNDB-2012-000012 http://struts.apache.org/2.3.1.2/docs/s2-007.html https://issues.apache.org/jira/browse/WW-3668 OCaml 3.12.1 and earlier computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. [oss-security] 20120206 CVE request: Hash DoS vulnerability (ocert-2011-003) [oss-security] 20120206 Re: CVE request: Hash DoS vulnerability (ocert-2011-003) [caml-list] 20111230 Hashtbl and security [caml-list] 20111230 Re: Hashtbl and security http://www.nruns.com/_downloads/advisory28122011.pdf http://www.ocert.org/advisories/ocert-2011-003.html tables/apr_hash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. [apr-commits] 20120115 svn commit: r1231605 - /apr/apr/trunk/tables/apr_hash.c [oss-security] 20120208 CVE request: apr - Hash DoS vulnerability [oss-security] 20120208 Re: CVE request: apr - Hash DoS vulnerability http://svn.apache.org/viewvc?rev=1231605&view=rev [dev] 20120105 Hash collision vectors in APR? [dev] 20120113 Re: Hash collision vectors in APR? [dev] 20120114 Re: Hash collision vectors in APR? MDVSA-2012:019 apacheapr-hash-dos(73096) libxml2 before 2.8.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660846 http://git.gnome.org/browse/libxml2/commit/?id=8973d58b7498fa5100a876815476b81fd1a2412a APPLE-SA-2013-10-22-8 APPLE-SA-2013-09-18-2 SUSE-SU-2013:1627 RHSA-2012:0324 RHSA-2013:0217 1026723 http://support.apple.com/kb/HT5934 http://support.apple.com/kb/HT6001 DSA-2417 MDVSA-2013:150 [oss-security] 20120222 libxml2: hash table collisions CPU usage DoS http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html 52107 http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf http://xmlsoft.org/news.html https://blogs.oracle.com/sunsecurity/entry/cve_2012_0841_denial_of SimpleXMLRPCServer.py in SimpleXMLRPCServer in Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an XML-RPC POST request that contains a smaller amount of data than specified by the Content-Length header. http://bugs.python.org/issue14001 APPLE-SA-2013-10-22-3 http://python.org/download/releases/2.6.8/ http://python.org/download/releases/2.7.3/ http://python.org/download/releases/3.1.5/ http://python.org/download/releases/3.2.3/ [oss-security] 20120213 Re: CVE Request -- python (SimpleXMLRPCServer): DoS (excessive CPU usage) via malformed XML-RPC / HTTP POST request 1026689 USN-1592-1 USN-1596-1 USN-1613-1 USN-1613-2 USN-1615-1 USN-1616-1 https://bugzilla.redhat.com/show_bug.cgi?id=789790 Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the Location variable. 20120119 Webcalendar 1.2.4 'location' XSS http://sourceforge.net/tracker/?func=detail&aid=3472745&group_id=3870&atid=103870 http://sourceforge.net/tracker/?func=detail&aid=3488543&group_id=3870&atid=303870 [oss-security] 20120211 CVE-request: Webcalendar 1.2.4 location XSS [oss-security] 20120211 Re: CVE-request: Webcalendar 1.2.4 location XSS [oss-security] 20120212 Re: CVE-request: Webcalendar 1.2.4 location XSS [oss-security] 20120213 Re: CVE-request: Webcalendar 1.2.4 location XSS 51600 webcalendar-location-xss(72563) Heap-based buffer overflow in the avfilter_filter_samples function in libavfilter/avfilter.c in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (application crash) via a crafted media file. http://ffmpeg.org/security.html http://git.videolan.org/?p=ffmpeg.git;a=commit;h=ae21776207e8a2bbe268e7c9e203f7599dd87ddb [oss-security] 20120201 Re: CVE Requests for FFmpeg 0.9.1 [oss-security] 20120214 Re: CVE Requests for FFmpeg 0.9.1 Heap-based buffer overflow in the ws_snd_decode_frame function in libavcodec/ws-snd1.c in FFmpeg 0.9.1 allows remote attackers to cause a denial of service (application crash) via a crafted media file, related to an incorrect calculation, aka "wrong samples count." http://ffmpeg.org/security.html http://git.videolan.org/?p=ffmpeg.git;a=commit;h=5257743aee0c3982f0079e6553aabc6aa39401d2 [oss-security] 20120201 Re: CVE Requests for FFmpeg 0.9.1 [oss-security] 20120214 Re: CVE Requests for FFmpeg 0.9.1 ffmpeg-wssnddecodeframe-bo(78936) Integer overflow in the ff_j2k_dwt_init function in libavcodec/j2k_dwt.c in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted JPEG2000 image that triggers an incorrect check for a negative value. http://ffmpeg.org/security.html http://git.videolan.org/?p=ffmpeg.git;a=commit;h=1f99939a6361e2e6d6788494dd7c682b051c6c34 http://www.ffmpeg.org/trac/ffmpeg/ticket/776 [oss-security] 20120201 Re: CVE Requests for FFmpeg 0.9.1 [oss-security] 20120214 Re: CVE Requests for FFmpeg 0.9.1 ffmpeg-ffj2kdwtinit-dos(78935) The sbr_qmf_synthesis function in libavcodec/aacsbr.c in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (application crash) via a crafted mpg file that triggers memory corruption involving the v_off variable, probably a buffer underflow. http://ffmpeg.org/security.html http://git.videolan.org/?p=ffmpeg.git;a=commit;h=944f5b2779e4aa63f7624df6cd4de832a53db81b [oss-security] 20120201 Re: CVE Requests for FFmpeg 0.9.1 [oss-security] 20120214 Re: CVE Requests for FFmpeg 0.9.1 ffmpeg-sbrqmfsynthesis-dos(78934) The ff_h264_decode_seq_parameter_set function in h264_ps.c in libavcodec in FFmpeg before 0.9.1 and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.6, and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted H.264 file, related to the chroma_format_idc value. http://ffmpeg.org/security.html http://ffmpeg.org/trac/ffmpeg/ticket/758 http://git.videolan.org/?p=ffmpeg.git;a=commit;h=7fff64e00d886fde11d61958888c82b461cf99b9 http://libav.org/ DSA-2494 MDVSA-2013:079 [oss-security] 20120214 Re: CVE Requests for FFmpeg 0.9.1 USN-1479-1 ffmpeg-ffh264decode-code-exec(78933) The adpcm_decode_frame function in adpcm.c in libavcodec in FFmpeg before 0.9.1 and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.6, and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an ADPCM file with the number of channels not equal to two. http://ffmpeg.org/security.html http://git.videolan.org/?p=ffmpeg.git;a=commit;h=608708009f69ba4cecebf05120c696167494c897 http://libav.org/ DSA-2494 [oss-security] 20120214 Re: CVE Requests for FFmpeg 0.9.1 USN-1479-1 ffmpeg-adpcmdecodeframe-code-exec(78932) https://ffmpeg.org/trac/ffmpeg/ticket/794 The decodeTonalComponents function in the Actrac3 codec (atrac3.c) in libavcodec in FFmpeg 0.7.x before 0.7.12, and 0.8.x before 0.8.11; and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1 allows remote attackers to cause a denial of service (infinite loop and crash) and possibly execute arbitrary code via a large component count in an Atrac 3 file. http://ffmpeg.org/trac/ffmpeg/ticket/780 http://git.libav.org/?p=libav.git;a=commit;h=c509f4f74713b035a06f79cb4d00e708f5226bc5 http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=9af6abdc17deb95c9b1f1d9242ba49b8b5e0b016 http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=c509f4f74713b035a06f79cb4d00e708f5226bc5 [oss-security] 20120214 Re: CVE Requests for FFmpeg 0.9.1 USN-1479-1 The dpcm_decode_frame function in libavcodec/dpcm.c in FFmpeg before 0.9.1 does not use the proper pointer after an audio API change, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors, which triggers a heap-based buffer overflow. http://ffmpeg.org/security.html http://git.videolan.org/?p=ffmpeg.git;a=commit;h=6d8e6fe9dbc365f50521cf0c4a5ffee97c970cb5 [oss-security] 20120201 Re: CVE Requests for FFmpeg 0.9.1 [oss-security] 20120214 Re: CVE Requests for FFmpeg 0.9.1 Heap-based buffer overflow in the get_sot function in the J2K decoder (j2k.c) in libavcodec in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (application crash) via unspecified vectors related to the curtileno variable. http://ffmpeg.org/security.html http://git.videolan.org/?p=ffmpeg.git;a=commit;h=3eedf9f716733b3b4c5205726d2c1ca52b3d3d78 [oss-security] 20120201 Re: CVE Requests for FFmpeg 0.9.1 [oss-security] 20120214 Re: CVE Requests for FFmpeg 0.9.1 ffmpeg-getsot-bo(78929) Heap-based buffer overflow in the MPV_frame_start function in libavcodec/mpegvideo.c in FFmpeg before 0.9.1, when the lowres option is enabled, allows remote attackers to cause a denial of service (application crash) via a crafted H263 media file. NOTE: this vulnerability exists because of a regression error. http://ffmpeg.org/security.html http://ffmpeg.org/trac/ffmpeg/ticket/757 http://git.videolan.org/?p=ffmpeg.git;a=commit;h=21270cffaeab2f67a613907516b2b0cd6c9eacf4 [oss-security] 20120201 Re: CVE Requests for FFmpeg 0.9.1 [oss-security] 20120214 Re: CVE Requests for FFmpeg 0.9.1 ffmpeg-mpvframestart-bo(78928) Multiple buffer overflows in the get_qcx function in the J2K decoder (j2kdec.c) in libavcode in FFmpeg before 0.9.1 allow remote attackers to cause a denial of service (application crash) via unspecified vectors. http://ffmpeg.org/security.html [oss-security] 20120201 Re: CVE Requests for FFmpeg 0.9.1 [oss-security] 20120214 Re: CVE Requests for FFmpeg 0.9.1 ffmpeg-getqcx-bo(78927) The Shorten codec (shorten.c) in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11, and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Shorten file, related to an "invalid free". http://ffmpeg.org/ http://git.libav.org/?p=libav.git;a=commitdiff;h=204cb29b3c84a74cbcd059d353c70c8bdc567d98 http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=204cb29b3c84a74cbcd059d353c70c8bdc567d98 http://libav.org/ [oss-security] 20120214 Re: CVE Requests for FFmpeg 0.9.1 USN-1479-1 The render_line function in the vorbis codec (vorbis.c) in libavcodec in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Vorbis file, related to a large multiplier. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3893. http://ffmpeg.org/security.html http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=6fcf2bb8af0e7d6bb179e71e67e5fab8ef0d2ec2 [oss-security] 20120214 Re: CVE Requests for FFmpeg 0.9.1 USN-1479-1 ffmpeg-renderline-code-exec(78925) Multiple untrusted search path vulnerabilities in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, allow local users to gain privileges via a Trojan horse (1) deployUtil.py or (2) vds_bootstrap.py Python module in /tmp/. Per: http://cwe.mitre.org/data/definitions/426.html 'Untrusted Search Path - CWE 426' RHSA-2012:1506 RHSA-2012:1508 56825 1027838 https://bugzilla.redhat.com/show_bug.cgi?id=790730 enterprise-rhev-priv-esc(80543) The vds_installer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vds_bootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via a man-in-the-middle attack. RHSA-2012:1505 RHSA-2012:1506 RHSA-2012:1508 56825 1027838 enterprise-ssl-certificates-mitm(80544) builtins.c in Xinetd before 2.3.15 does not check the service type when the tcpmux-server service is enabled, which exposes all enabled services and allows remote attackers to bypass intended access restrictions via a request to tcpmux port 1. FEDORA-2012-8061 FEDORA-2012-8041 RHSA-2013:1302 MDVSA-2012:155 [oss-security] 20120509 CVE-2012-0862 assignment notification: xinetd enables unintentional services over tcpmux port [oss-security] 20120510 Re: CVE-2012-0862 assignment notification: xinetd enables unintentional services over tcpmux port 53720 1027050 http://www.xinetd.org/#changes https://bugzilla.redhat.com/attachment.cgi?id=583311 https://bugzilla.redhat.com/show_bug.cgi?id=790940 xinetd-tcpmux-weak-security(75965) Mumble 1.2.3 and earlier uses world-readable permissions for .local/share/data/Mumble/.mumble.sqlite files in home directories, which might allow local users to obtain a cleartext password and configuration data by reading a file. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659039 http://bugs.gentoo.org/show_bug.cgi?id=403939 47951 DSA-2411 [oss-security] 20120215 CVE request: mumble local information disclosure [oss-security] 20120215 Re: CVE request: mumble local information disclosure 52024 https://bugs.launchpad.net/ubuntu/+source/mumble/+bug/783405 https://bugzilla.redhat.com/show_bug.cgi?id=791000 https://github.com/mumble-voip/mumble/commit/5632c35d6759f5e13a7dfe78e4ee6403ff6a8e3e Integer overflow in the vfprintf function in stdio-common/vfprintf.c in glibc 2.14 and other versions allows context-dependent attackers to bypass the FORTIFY_SOURCE protection mechanism, conduct format string attacks, and write to arbitrary memory via a large number of arguments. RHSA-2012:0393 RHSA-2012:0397 RHSA-2012:0488 RHSA-2012:0531 http://sourceware.org/git/?p=glibc.git;a=commitdiff;h=7c1f4834d398163d1ac8101e35e9c36fc3176e6e [libc-alpha] 20120202 [PATCH] vfprintf: validate nargs and positional offsets http://www.phrack.org/issues.html?issue=67&id=9#article 52201 https://bugzilla.redhat.com/show_bug.cgi?id=794766 Multiple open redirect vulnerabilities in CubeCart 3.0.20 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) r parameter to switch.php or (2) goto parameter to admin/login.php. 20120210 CubeCart 3.0.20 (3.0.x) and lower | Open URL Redirection Vulnerability [oss-security] 20120212 CubeCart 3.0.20 (3.0.x) and lower | Open URL Redirection Vulnerability [oss-security] 20120213 Re: CubeCart 3.0.20 (3.0.x) and lower | Open URL Redirection Vulnerability [oss-security] 20120217 Re: CubeCart 3.0.20 (3.0.x) and lower | Open URL Redirection Vulnerability 51966 1026711 http://yehg.net/lab/pr0js/advisories/%5Bcubecart_3.0.20_3.0.x%5D_open_url_redirection CREATE TRIGGER in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 does not properly check the execute permission for trigger functions marked SECURITY DEFINER, which allows remote authenticated users to execute otherwise restricted triggers on arbitrary data by installing the trigger on an attacker-owned table. http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 openSUSE-SU-2012:1173 RHSA-2012:0677 RHSA-2012:0678 DSA-2418 MDVSA-2012:026 MDVSA-2012:027 MDVSA-2012:092 http://www.postgresql.org/about/news/1377/ http://www.postgresql.org/docs/8.3/static/release-8-3-18.html http://www.postgresql.org/docs/8.4/static/release-8-4-11.html http://www.postgresql.org/docs/9.0/static/release-9-0-7.html http://www.postgresql.org/docs/9.1/static/release-9-1-3.html PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters. openSUSE-SU-2012:1173 RHSA-2012:0678 DSA-2418 MDVSA-2012:026 http://www.postgresql.org/about/news/1377/ http://www.postgresql.org/docs/8.4/static/release-8-4-11.html http://www.postgresql.org/docs/9.0/static/release-9-0-7.html http://www.postgresql.org/docs/9.1/static/release-9-1-3.html CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL commands via a crafted file containing object names with newlines, which are inserted into an SQL script that is used when the database is restored. http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 openSUSE-SU-2012:1173 RHSA-2012:0677 RHSA-2012:0678 DSA-2418 MDVSA-2012:026 MDVSA-2012:027 http://www.postgresql.org/about/news/1377/ http://www.postgresql.org/docs/8.3/static/release-8-3-18.html http://www.postgresql.org/docs/8.4/static/release-8-4-11.html http://www.postgresql.org/docs/9.0/static/release-9-0-7.html http://www.postgresql.org/docs/9.1/static/release-9-1-3.html Cross-site scripting (XSS) vulnerability in fup in Frams' Fast File EXchange (F*EX, aka fex) before 20120215 allows remote attackers to inject arbitrary web script or HTML via the id parameter. 20120220 Vulnerabilitites in Debian F*EX <= 20100208 and F*EX 20111129-2. 20120220 Re: Vulnerabilitites in Debian F*EX <= 20100208 and F*EX 20111129-2. http://fex.rus.uni-stuttgart.de/fex.html DSA-2414 [oss-security] 20120220 Vulnerabilitites in Debian F*EX <= 20100208 and F*EX 20111129-2. [oss-security] 20120220 Re: Vulnerabilitites in Debian F*EX <= 20100208 and F*EX 20111129-2. [oss-security] 20120223 Re: Vulnerabilitites in Debian F*EX <= 20100208 and F*EX 20111129-2. 52085 fastfileexchange-fup-id-xss(78966) Heap-based buffer overflow in process.c in smbd in Samba 3.0, as used in the file-sharing service on the BlackBerry PlayBook tablet before 2.0.0.7971 and other products, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a Batched (aka AndX) request that triggers infinite recursion. http://btsc.webapps.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB29565 APPLE-SA-2012-05-09-1 SUSE-SU-2012:0337 SUSE-SU-2012:0338 SUSE-SU-2012:0502 SUSE-SU-2012:0515 http://support.apple.com/kb/HT5281 USN-1374-1 https://bugzilla.redhat.com/show_bug.cgi?id=795509 blackberry-playbook-samba-code-execution(73361) The session_link_x11_socket function in login/logind-session.c in systemd-logind in systemd, possibly 37 and earlier, allows local users to create or overwrite arbitrary files via a symlink attack on the X11 user directory in /run/user/. http://cgit.freedesktop.org/systemd/systemd/commit/?id=fc3c1c6e091ea16ad5600b145201ec535bbb5d7c SUSE-SA:2012:001 https://bugzilla.novell.com/show_bug.cgi?id=747154 https://bugzilla.redhat.com/show_bug.cgi?id=795853 Multiple cross-site scripting (XSS) vulnerabilities in OxWall 1.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) captchaField, (2) email, (3) form_name, (4) password, (5) realname, (6) repeatPassword, or (7) username parameters to Oxwall/join; (8) captcha, (9) email, (10) form_name, (11) from, or (12) subject parameters to Oxwall/contact; (13) tag parameter to Oxwall/blogs/browse-by-tag; or (14) PATH_INFO to Oxwall/photo/viewlist/tagged, (15) Oxwall/photo/viewlist, or (16) Oxwall/video/viewlist. 20120220 OxWall 1.1.1 <= Multiple Cross Site Scripting Vulnerabilities 20120220 Re: [oss-security] OxWall 1.1.1 <= Multiple Cross Site Scripting Vulnerabilities [oss-security] 20120220 Re: OxWall 1.1.1 <= Multiple Cross Site Scripting Vulnerabilities [oss-security] 20120221 OxWall 1.1.1 <= Multiple Cross Site Scripting Vulnerabilities 52090 http://yehg.net/lab/pr0js/advisories/%5BOxWall_1.1.1%5D_xss oxwall-multiple-xss(73466) Multiple cross-site scripting (XSS) vulnerabilities in Boonex Dolphin before 7.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) explain parameter to explanation.php or the (2) photos_only, (3) online_only, or (4) mode parameters to viewFriends.php. 20120220 Dolphin 7.0.7 <= Multiple Cross Site Scripting Vulnerabilities http://www.boonex.com/n/dolphin-7-0-8-released http://www.boonex.com/trac/dolphin/changeset/15282 http://www.boonex.com/trac/dolphin/changeset/15283 http://www.boonex.com/trac/dolphin/ticket/2530 [oss-security] 20120220 Re: Dolphin 7.0.7 <= Multiple Cross Site Scripting Vulnerabilities [oss-security] 20120221 Dolphin 7.0.7 <= Multiple Cross Site Scripting Vulnerabilities 52088 http://yehg.net/lab/pr0js/advisories/%5BDolphin_7.0.7%5D_xss The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 do not require authentication by default in certain profiles, which might allow remote attackers to invoke MBean methods and execute arbitrary code via unspecified vectors. NOTE: this issue can only be exploited when the interceptor is not properly configured with a "second layer of authentication," or when used in conjunction with other vulnerabilities that bypass this second layer. Per http://rhn.redhat.com/errata/RHSA-2013-0192.html "This JBoss Enterprise Application Platform 5.2.0 release serves as a replacement for JBoss Enterprise Application Platform 5.1.2, and includes bug fixes and enhancements." Per http://rhn.redhat.com/errata/RHSA-2013-0196.html "This JBoss Enterprise Web Platform 5.2.0 release serves as a replacement for JBoss Enterprise Web Platform 5.1.2, and includes bug fixes and enhancements." 20131219 ESA-2013-094: EMC Data Protection Advisor JBOSS Remote Code Execution Vulnerability RHSA-2013:0191 RHSA-2013:0192 RHSA-2013:0193 RHSA-2013:0194 RHSA-2013:0195 RHSA-2013:0196 RHSA-2013:0197 RHSA-2013:0198 RHSA-2013:0221 RHSA-2013:0533 1028042 30211 57552 https://bugzilla.redhat.com/show_bug.cgi?id=795645 jboss-eap-jmxinvokerhaservlet-code-exec(81511) SystemTap 1.7, 1.6.7, and probably other versions, when unprivileged mode is enabled, allows local users to obtain sensitive information from kernel memory or cause a denial of service (kernel panic and crash) via vectors related to crafted DWARF data, which triggers a read of an invalid pointer. openSUSE-SU-2013:0475 [oss-security] 20120222 CVE-2012-0875: systemtap memory disclosure/kernel panic when processing malformed DWARF unwind data RHSA-2012:0376 1026777 http://sourceware.org/bugzilla/show_bug.cgi?id=13714 http://sourceware.org/git/?p=systemtap.git;a=commit;h=64b0cff3b The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value. http://bugs.python.org/issue13703#msg151870 APPLE-SA-2013-10-22-3 APPLE-SA-2015-12-08-3 [Expat-discuss] 20120304 Announcement: Expat 2.1.0 Beta can be tested RHSA-2012:0731 RHSA-2016:0062 RHSA-2016:2957 http://sourceforge.net/projects/expat/files/expat/2.1.0/ http://sourceforge.net/tracker/?func=detail&atid=110127&aid=3496608&group_id=10127 DSA-2525 MDVSA-2012:041 http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html 52379 USN-1527-1 USN-1613-1 USN-1613-2 https://support.apple.com/HT205637 https://www.tenable.com/security/tns-2016-20 Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem. http://groups.google.com/group/paste-users/browse_thread/thread/2aa651ba331c2471 RHSA-2012:1206 [oss-security] 20120223 CVE Request -- python-paste-script: Supplementary groups not dropped when started an application with "paster serve" as root [oss-security] 20120223 Re: CVE Request -- python-paste-script: Supplementary groups not dropped when started an application with "paster serve" as root https://bitbucket.org/ianb/pastescript/changeset/a19e462769b4 https://bitbucket.org/ianb/pastescript/pull-request/3/fix-group-permissions-for-pastescriptserve https://bugzilla.redhat.com/show_bug.cgi?id=796790 The I/O implementation for block devices in the Linux kernel before 2.6.33 does not properly handle the CLONE_IO feature, which allows local users to cause a denial of service (I/O instability) by starting multiple processes that share an I/O context. http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.33 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=61cc74fbb87af6aa551a06a370590c9bc07e29d9 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b69f2292063d2caf37ca9aec7d63ded203701bf3 SUSE-SU-2012:0616 HPSBGN02970 RHSA-2012:0481 RHSA-2012:0531 DSA-2469 [oss-security] 20120223 Re: CVE request -- kernel: block: CLONE_IO io_context refcounting issues 1027086 USN-1408-1 USN-1410-1 USN-1411-1 https://bugzilla.redhat.com/show_bug.cgi?id=796829 https://github.com/torvalds/linux/commit/61cc74fbb87af6aa551a06a370590c9bc07e29d9 https://github.com/torvalds/linux/commit/b69f2292063d2caf37ca9aec7d63ded203701bf3 Apache Xerces-C++ allows remote attackers to cause a denial of service (CPU consumption) via a crafted message sent to an XML service that causes hash table collisions. [oss-security] 20140708 Summer bug cleaning - some Hash DoS stuff https://bugzilla.redhat.com/show_bug.cgi?id=787103 Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions. [oss-security] 20140708 Summer bug cleaning - some Hash DoS stuff https://bugzilla.redhat.com/show_bug.cgi?id=787104 https://issues.apache.org/jira/browse/XERCESJ-1685 [j-users] 20180503 [ANNOUNCEMENT]: Apache Xerces-J 2.12.0 now available Buffer overflow in yaSSL, as used in MySQL 5.5.20 and possibly other versions including 5.5.x before 5.5.22 and 5.1.x before 5.1.62, allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VulnDisco Pack Professional 9.17. NOTE: as of 20120224, this disclosure has no actionable information. However, because the module author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes. NOTE: due to lack of details, it is not clear whether this issue is a duplicate of CVE-2012-0492 or another CVE. [oss-security] 20120224 Re: MySQL 0-day - does it need a CVE? https://blogs.oracle.com/sunsecurity/entry/cve_2012_0882buffer_overflow_vulnerability https://bugzilla.redhat.com/show_bug.cgi?id=789141 [Canvas] 20120207 VulnDisco Pack Professional 9.17 [Canvas] 20120223 VulnDisco MySQL 0day envvars (aka envvars-std) in the Apache HTTP Server before 2.4.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse DSO in the current working directory during execution of apachectl. [dev] 20120417 [ANNOUNCEMENT] Apache HTTP Server 2.4.2 Released APPLE-SA-2013-09-12-1 openSUSE-SU-2013:0243 openSUSE-SU-2013:0248 SSRT100856 http://support.apple.com/kb/HT5880 http://svn.apache.org/viewvc?view=revision&revision=1296428 http://www.apache.org/dist/httpd/Announcement2.4.html http://www.apachelounge.com/Changelog-2.4.html 53046 1026932 http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf apache-ldlibrarypath-code-execution(74901) SSRT101209 https://httpd.apache.org/security/vulnerabilities_24.html [httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html The implementation of Cryptographic Message Syntax (CMS) and PKCS #7 in OpenSSL before 0.9.8u and 1.x before 1.0.0h does not properly restrict certain oracle behavior, which makes it easier for context-dependent attackers to decrypt data via a Million Message Attack (MMA) adaptive chosen ciphertext attack. FEDORA-2012-4665 FEDORA-2012-4659 FEDORA-2012-4630 FEDORA-2012-18035 HPSBUX02782 SSRT100852 HPSBOV02793 RHSA-2012:0426 RHSA-2012:0488 RHSA-2012:0531 RHSA-2012:1306 RHSA-2012:1307 RHSA-2012:1308 48580 DSA-2454 VU#737740 http://www.openssl.org/news/secadv_20120312.txt http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004564 https://downloads.avaya.com/css/P8/documents/100162507 openSUSE-SU-2012:0547 chan_sip.c in Asterisk Open Source 1.8.x before 1.8.8.2 and 10.x before 10.0.1, when the res_srtp module is used and media support is improperly configured, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted SDP message with a crypto attribute and a (1) video or (2) text media type, as demonstrated by CSipSimple. http://downloads.asterisk.org/pub/security/AST-2012-001.html http://downloads.asterisk.org/pub/security/AST-2012-001-1.8.diff http://downloads.asterisk.org/pub/security/AST-2012-001-10.diff [oss-security] 20120120 CVE Request -- Asterisk AST-2012-001 / Remote DoS while processing crypto line for media stream with non-existing RTP [oss-security] 20120120 Re: CVE Request -- Asterisk AST-2012-001 / Remote DoS while processing crypto line for media stream with non-existing RTP https://bugzilla.redhat.com/show_bug.cgi?id=783487 https://issues.asterisk.org/jira/browse/ASTERISK-19202 https://issues.asterisk.org/jira/secure/attachment/42202/issueA19202_crypto_if_uninited_text_or_video.patch Multiple cross-site scripting (XSS) vulnerabilities in Puppet Dashboard 1.0 before 1.2.5 and Enterprise 1.0 before 1.2.5 and 2.x before 2.0.1 allow remote attackers to inject arbitrary web script or HTML via unspecified fields. http://puppetlabs.com/security/cve/cve-2012-0891 Cross-site scripting (XSS) vulnerability in map/map.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the map parameter. http://packetstormsecurity.org/files/108631/countperday-downloadxss.txt http://plugins.trac.wordpress.org/changeset/488883/count-per-day http://wordpress.org/extend/plugins/count-per-day/changelog/ 18355 51402 countperday-map-xss(72384) Absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter. http://packetstormsecurity.org/files/108631/countperday-downloadxss.txt http://plugins.trac.wordpress.org/changeset/488883/count-per-day http://wordpress.org/extend/plugins/count-per-day/changelog/ 18355 51402 countperday-download-file-download(72385) Stack-based buffer overflow in the JPEG2000 plugin in IrfanView PlugIns before 4.33 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment. http://www.irfanview.com/history_old.htm 51426 1032529 1032530 irfanview-qcd-bo(72398) Directory traversal vulnerability in meb_download.php in the myEASYbackup plugin 1.0.8.1 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the dwn_file parameter. http://packetstormsecurity.org/files/view/108711/wpmyeasybackup-traversal.txt myeasy-mebdownload-directory-traversal(72404) Cross-site scripting (XSS) vulnerability in referencement/sites_inscription.php in Annuaire PHP allows remote attackers to inject arbitrary web script or HTML via the url parameter and possibly the nom parameter. http://packetstormsecurity.org/files/view/108719/annuaire-xss.txt 51434 annuaire-sitesinscription-xss(72407) Multiple cross-site scripting (XSS) vulnerabilities in Beehive Forum 1.0.1 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) forum/register.php or (2) forum/logon.php. 20120115 Beehive Forum 101 Multiple XSS vulnerabilities http://www.darksecurity.de/advisories/SSCHADV2011-042.txt 51424 beehiveforum101-multiple-xss(72411) Cross-site scripting (XSS) vulnerability in yousaytoo.php in YouSayToo auto-publishing plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit parameter. http://packetstormsecurity.org/files/view/108470/wpystap-xss.txt yousaytooautopublishing-yousaytoo-xss(72271) AirTies Air 4450 1.1.2.18 allows remote attackers to cause a denial of service (reboot) via a direct request to cgi-bin/loader. 18336 51320 airties-4450-cgibin-dos(72200) Multiple cross-site scripting (XSS) vulnerabilities in Zimbra Desktop 7.1.2 b10978 allow remote attackers to inject arbitrary web script or HTML via the (1) Username or (2) MailBox Name. http://packetstormsecurity.org/files/view/108715/VL-378.txt 20120116 Zimbra Desktop v7.1.2 - Persistent Software Vulnerability 51436 http://www.vulnerability-lab.com/get_content.php?id=378 zimbra-labelname-xss(72405) VLC media player 1.1.11 allows remote attackers to cause a denial of service (crash) via a long string in an amr file. 20120104 VLC media player v1.1.11 (.amr) Local Crash PoC 18309 51255 vlcmediaplayer-amr-dos(72085) oval:org.mitre.oval:def:14327 SQL injection vulnerability in deV!L'z Clanportal (DZCP) Gamebase addon allows remote attackers to execute arbitrary SQL commands via the gameid parameter in a detail action to index.php. 18385 clanportal-index-sql-injection(72452) SQL injection vulnerability in the Moviebase addon for deV!L'z Clanportal (DZCP) 1.5.5 allows remote attackers to execute arbitrary SQL commands via the id parameter in a showkat action to index.php. 18386 clanportal-id-sql-injection(72453) Directory traversal vulnerability in the web player in NeoAxis NeoAxis web player 1.4 and earlier allows user-assisted remote attackers to write arbitrary files via a .. (dot dot) in a filename in the neoaxis_web_application_win32.zip ZIP archive. http://aluigi.altervista.org/adv/neoaxis_1-adv.txt neoaxis-neoaxis-directory-traversal(72427) Cross-site scripting (XSS) vulnerability in logout.php in SimpleSAMLphp 1.8.1 and possibly other versions before 1.8.2 allows remote attackers to inject arbitrary web script or HTML via the link_href parameter. http://code.google.com/p/simplesamlphp/issues/detail?id=468 [oss-security] 20120120 Re: CVE request: simpleSAMLphp 1.8.2 cross site scripting 51372 simplesamlphp-nocookie-logout-xss(72313) Cross-site scripting (XSS) vulnerability in Horde_Form in Horde Groupware Webmail Edition before 4.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to email verification. NOTE: Some of these details are obtained from third party information. http://www.horde.org/apps/webmail/docs/CHANGES http://www.horde.org/apps/webmail/docs/RELEASE_NOTES [oss-security] 20120121 Re: Re: CVE Request -- Horde IMP -- Multiple XSS flaws 51586 TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieName to lib/banners/bannerlib.php; (2) printpages or (3) printstructures parameter to (a) tiki-print_multi_pages.php or (b) tiki-print_pages.php; or (4) sendpages, (5) sendstructures, or (6) sendarticles parameter to tiki-send_objects.php, which is not properly handled when processed by the unserialize function. 20120704 [CVE-2012-0911] Tiki Wiki CMS Groupware <= 8.3 "unserialize()" PHP Code Execution http://dev.tiki.org/item4109 http://info.tiki.org/article190-Tiki-Wiki-CMS-Groupware-Updates-Tiki-6-7-LTS http://info.tiki.org/article191-Tiki-Releases-8-4 19573 19630 54298 tikiwiki-unserialize-code-exec(76758) SQL injection vulnerability in Stoneware webNetwork before 6.0.8.0 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. http://www.stone-ware.com/support/techdocs/kb/d1960/sb_6_0_8.pdf http://www.stone-ware.com/swql.jsp?kb=d1960 SQL injection vulnerability in checklogin.aspx in ICloudCenter ICTimeAttendance 1.0 allows remote attackers to execute arbitrary SQL commands via the passw parameter. NOTE: Some of these details are obtained from third party information. 18394 51589 ictimeattendance-passw-sql-injection(72569) Cross-site scripting (XSS) vulnerability in display_renderers/panels_renderer_editor.class.php in the admin view in the Panels module 6.x-2.x before 6.x-3.10 and 7.x-3.x before 7.x-3.0 for Drupal allows remote authenticated users with certain privileges to inject arbitrary web script or HTML via the Region title. http://drupal.org/node/1409436 http://drupal.org/node/1409446 http://drupal.org/node/1409448 http://drupalcode.org/project/panels.git/commit/2066d59 http://drupalcode.org/project/panels.git/commit/d844942 http://www.madirish.net/content/drupal-panels-6x-39-xss-vulnerability 51568 drupal-panels-unspecified-xss(72549) Integer signedness error in RenRen Talk 2.9 allows remote attackers to execute arbitrary code via crafted dimensions of a skin file, leading to a heap-based buffer overflow, as demonstrated using a BMP image. 51585 Heap-based buffer overflow in RenRen Talk 2.9 allows remote attackers to execute arbitrary code via a crafted image in a chat message, as demonstrated using a PNG file. 51585 Cross-site scripting (XSS) vulnerability in Hitachi IT Operations Analyzer 02-01, 02-51 through 02-51-01, and 02-53 through 02-53-02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-001/index.html 51340 hitachi-it-unspecified-xss(72248) Unspecified vulnerability in Hitachi COBOL2002 Net Developer, Net Server Suite, and Net Client Suite 01-00, 01-01 through 01-01-/D, 01-02 through 01-02-/F, 01-03 through 01-03-/F, 02-00 through 02-00-/D, 02-01 through 02-01-/C, and possibly other versions before 02-01-/D allows remote attackers to execute arbitrary code via unknown attack vectors. http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-002/index.html 51580 hitachi-cobol2002-unspec-code-exec(72558) Cross-site scripting (XSS) vulnerability in Hitachi IT Operations Director 02-50-01 through 02-50-07, 03-00 through 03-00-04, and possibly other versions before 03-00-06, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-001/index.html 51340 hitachi-it-unspecified-xss(72248) Use-after-free vulnerability in Dropbear SSH Server 0.52 through 2012.54, when command restriction and public key authentication are enabled, allows remote authenticated users to execute arbitrary code and bypass command restrictions via multiple crafted command requests, related to "channels concurrency." http://matt.ucc.asn.au/dropbear/CHANGES DSA-2456 52159 dropbear-code-execution(73444) https://secure.ucc.asn.au/hg/dropbear/rev/818108bf7749 https://www.mantor.org/~northox/misc/CVE-2012-0920.html rvrender.dll in RealNetworks RealPlayer 11.x, 14.x, and 15.x before 15.02.71, and RealPlayer SP 1.0 through 1.1.5, allows remote attackers to execute arbitrary code via crafted flags in an RMFF file. http://service.real.com/realplayer/security/02062012_player/en/ 51883 realplayer-rmff-code-execution(73018) The RV20 codec in RealNetworks RealPlayer 11.x, 14.x, and 15.x before 15.02.71, and RealPlayer SP 1.0 through 1.1.5, does not properly handle the frame size array, which allows remote attackers to execute arbitrary code via a crafted RV20 RealVideo video stream. http://service.real.com/realplayer/security/02062012_player/en/ 51884 RealNetworks RealPlayer 11.x, 14.x, and 15.x before 15.02.71, and RealPlayer SP 1.0 through 1.1.5, allows remote attackers to execute arbitrary code via vectors involving a VIDOBJ_START_CODE code in a header within a video stream. http://service.real.com/realplayer/security/02062012_player/en/ Unspecified vulnerability in the RV40 codec in RealNetworks RealPlayer 11.x, 14.x, and 15.x before 15.02.71, and RealPlayer SP 1.0 through 1.1.5, allows remote attackers to execute arbitrary code via a crafted RV40 RealVideo video stream. http://service.real.com/realplayer/security/02062012_player/en/ 51887 realplayer-rv40-code-exec(73021) The RV10 codec in RealNetworks RealPlayer 11.x, 14.x, and 15.x before 15.02.71, and RealPlayer SP 1.0 through 1.1.5, does not properly handle height and width values, which allows remote attackers to execute arbitrary code via a crafted RV10 RealVideo video stream. http://service.real.com/realplayer/security/02062012_player/en/ Unspecified vulnerability in RealNetworks RealPlayer 11.x, 14.x, and 15.x before 15.02.71, and RealPlayer SP 1.0 through 1.1.5, allows remote attackers to execute arbitrary code via vectors involving the coded_frame_size value in a RealAudio audio stream. http://service.real.com/realplayer/security/02062012_player/en/ The ATRAC codec in RealNetworks RealPlayer 11.x and 14.x through 14.0.7, RealPlayer SP 1.0 through 1.1.5, and Mac RealPlayer 12.x before 12.0.0.1703 does not properly decode samples, which allows remote attackers to execute arbitrary code via a crafted ATRAC audio file. http://service.real.com/realplayer/security/02062012_player/en/ Multiple buffer overflows in Schneider Electric Modicon Quantum PLC allow remote attackers to cause a denial of service via malformed requests to the (1) FTP server or (2) HTTP server. 51605 http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-12-020-03.pdf schneider-modicon-http-dos(72588) schneider-modicon-ftp-dos(72589) Cross-site scripting (XSS) vulnerability in Schneider Electric Modicon Quantum PLC allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. 51605 http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-12-020-03.pdf schneider-modicon-unspec-xss(72590) Schneider Electric Modicon Quantum PLC does not perform authentication between the Unity software and PLC, which allows remote attackers to cause a denial of service or possibly execute arbitrary code via unspecified vectors. 51605 http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-12-020-03.pdf schneider-modicon-unity-dos(72586) Cross-site scripting (XSS) vulnerability in admin/login.php in Lead Capture Page System allows remote attackers to inject arbitrary web script or HTML via the message parameter. http://packetstormsecurity.org/files/108887/leadcapturepagesystem-xss.txt leadcapture-login-xss(72623) Multiple cross-site scripting (XSS) vulnerabilities in Acidcat CMS 3.5.1, 3.5.2, 3.5.6, and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) admin_colors.asp, (2) admin_config.asp, and (3) admin_cat_add.asp in admin/. http://packetstormsecurity.org/files/108869/acidcat-xss.txt 51608 acidcatcms-multiple-xss(72624) PHP remote file inclusion vulnerability in ajax/savetag.php in the Theme Tuner plugin for WordPress before 0.8 allows remote attackers to execute arbitrary PHP code via a URL in the tt-abspath parameter. http://plugins.trac.wordpress.org/changeset/492167/theme-tuner#file2 http://spareclockcycles.org/2011/09/18/exploitring-the-wordpress-extension-repos/ http://wordpress.org/extend/plugins/theme-tuner/changelog/ 51636 themetuner-savetag-file-include(72626) SQL injection vulnerability in Default.aspx in Aryadad CMS allows remote attackers to execute arbitrary SQL commands via the PageID parameter. 18405 51627 aryadad-default-sql-injection(72639) Cross-site scripting (XSS) vulnerability in web/springframework/security/SecurityAuthenticationEventOnmsEventBuilder.java in OpenNMS 1.8.x before 1.8.17, 1.9.93 and earlier, and 1.10.x before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via the Username field, related to login. http://fisheye.opennms.org/browse/opennms/features/springframework-security/src/main/java/org/opennms/web/springframework/security/SecurityAuthenticationEventOnmsEventBuilder.java?r2=d2ce15470cb6c87c115c918eb86ef147486a9166&r1=80b80e110e4bce568fc2c6c0a15a http://issues.opennms.org/browse/NMS/fixforversion/10824#atl_token=BCL8-RCDX-MB62-2EZT%7C38eaf469042162355c28f5393587690a8388d556%7Clout&selectedTab=com.atlassian.jira.plugin.system.project%3Aversion-summary-panel http://issues.opennms.org/browse/NMS/fixforversion/10825 http://issues.opennms.org/browse/NMS-5128?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel#issue-tabs 51632 opennms-username-xss(72625) ** DISPUTED ** wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not limit the number of MySQL queries sent to external MySQL database servers, which allows remote attackers to use WordPress as a proxy for brute-force attacks or denial of service attacks via the dbhost parameter, a different vulnerability than CVE-2011-4898. NOTE: the vendor disputes the significance of this issue because an incomplete WordPress installation might be present on the network for only a short time. 20120124 TWSL2012-002: Multiple Vulnerabilities in WordPress 18417 https://www.trustwave.com/spiderlabs/advisories/TWSL2012-002.txt Multiple SQL injection vulnerabilities in TestLink 1.9.3, 1.8.5b, and earlier allow remote authenticated users with certain permissions to execute arbitrary SQL commands via the root_node parameter in the display_children function to (1) getrequirementnodes.php or (2) gettprojectnodes.php in lib/ajax/; the (3) cfield_id parameter in an edit action to lib/cfields/cfieldsEdit.php; the (4) id parameter in an edit action or (5) plan_id parameter in a create action to lib/plan/planMilestonesEdit.php; or the req_spec_id parameter to (6) reqImport.php or (7) in a create action to reqEdit.php in lib/requirements/. NOTE: some of these details are obtained from third party information. 20120220 SQL Injection Vulnerabilities in TestLink 52086 testlink-multiple-scripts-sql-injection(73327) Multiple SQL injection vulnerabilities in TestLink 1.8.5b and earlier allow remote authenticated users with the Requirement view permission to execute arbitrary SQL commands via the req_spec_id parameter to (1) reqSpecAnalyse.php, (2) reqSpecPrint.php, or (3) reqSpecView.php in requirements/. NOTE: some of these details are obtained from third party information. 20120220 SQL Injection Vulnerabilities in TestLink 52086 testlink-multiple-parameters-sql-injection(73389) Multiple cross-site scripting (XSS) vulnerabilities in Fortinet FortiGate UTM WAF appliances with FortiOS 4.3.x before 4.3.6 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) Endpoint Monitor, (2) Dialup List, or (3) Log&Report Display modules, or the fields_sorted_opt parameter to (4) user/auth/list or (5) endpointcompliance/app_detect/predefined_sig_list. http://packetstormsecurity.org/files/109168/VL-144.txt 51708 fortigateutm-fieldssortedopt-xss(72761) https://fortiguard.com/psirt/FG-IR-012-001 1026594 https://www.vulnerability-lab.com/get_content.php?id=144 Buffer overflow in rn5auth.dll in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attackers to execute arbitrary code via crafted authentication credentials. http://helixproducts.real.com/docs/security/SecurityUpdate04022012HS.pdf 52929 1026898 debian/guest-account in Light Display Manager (lightdm) 1.0.x before 1.0.6 and 1.1.x before 1.1.7, as used in Ubuntu Linux 11.10, allows local users to delete arbitrary files via a space in the name of a file in /tmp. NOTE: this identifier was SPLIT per ADT1/ADT2 due to different codebases and affected versions. CVE-2012-6648 has been assigned for the gdm-guest-session issue. USN-1399-2 https://bugs.launchpad.net/ubuntu/%2Bsource/lightdm/%2Bbug/953044 https://launchpadlibrarian.net/96471251/lightdm.secure-cleanup.debdiff Aptdaemon 0.43 and earlier in Ubuntu 11.04, 11.10, and 12.04 LTS does not authenticate packages when the transaction is not simulated, which allows remote attackers to install arbitrary packages via a man-in-the-middle attack. USN-1414-1 52855 https://bugs.launchpad.net/ubuntu/%2Bsource/aptdaemon/%2Bbug/959131 aptdaemon-transaction-security-bypass(74553) The NVIDIA UNIX driver before 295.40 allows local users to access arbitrary memory locations by leveraging GPU device-node read/write privileges. http://nvidia.custhelp.com/app/answers/detail/a_id/3109 48650 USN-1420-1 nvidia-graphics-gpu-priv-escalation(74822) Heap-based buffer overflow in the vqa_decode_chunk function in the VQA codec (vqavideo.c) in libavcodec in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.6, and 0.8.x before 0.8.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VQA media file in which the image size is not a multiple of the block size. http://git.libav.org/?p=libav.git;a=commit;h=58b2e0f0f2fc96c1158e04f8aba95cbe6157a1a3 http://libav.org/ DSA-2471 [oss-security] 20120503 Security issue in libav/ffmpeg 53389 USN-1479-1 https://bugs.launchpad.net/ubuntu/+source/libav/+bug/980963 DistUpgrade/DistUpgradeMain.py in Update Manager, as used by Ubuntu 12.04 LTS, 11.10, and 11.04, uses weak permissions for (1) apt-clone_system_state.tar.gz and (2) system_state.tar.gz, which allows local users to obtain repository credentials. http://launchpadlibrarian.net/105380733/update-manager_1%3A0.156.14.3_1%3A0.156.14.4.diff.gz 53604 USN-1443-1 update-manager-info-disclosure(75727) The Apport hook in Update Manager as used by Ubuntu 12.04 LTS, 11.10, and 11.04 uploads certain system state archive files when reporting bugs to Launchpad, which allows remote attackers to read repository credentials by viewing a public bug report. 53605 USN-1443-1 update-manager-archives-info-disclosure(75728) The Apport hook (DistUpgradeApport.py) in Update Manager, as used by Ubuntu 12.04 LTS, 11.10, and 11.04, uploads the /var/log/dist-upgrade directory when reporting bugs to Launchpad, which allows remote attackers to read repository credentials by viewing a public bug report. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0949. USN-1443-2 https://bugs.launchpad.net/ubuntu/%2Bsource/update-manager/%2Bbug/1004503 APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install altered packages via a man-in-the-middle (MITM) attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3587. 20120612 Strange gpg key shadowing 20120614 Using second gpg keyring may be misleading? 20120615 ubuntu apt-key (part 3) 54046 USN-1475-1 USN-1477-1 https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013128 https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013639 https://bugs.launchpad.net/ubuntu/+source/apt/+bug/1013681 ubiquity-slideshow-ubuntu before 58.2, during installation, allows remote man-in-the-middle attackers to execute arbitrary web script or HTML and read arbitrary files via a crafted attribute in the <a> tag of a Twitter feed. USN-1561-1 https://bugs.launchpad.net/ubuntu/%2Bsource/ubiquity-slideshow-ubuntu/%2Bbug/991982 The override_release function in kernel/sys.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from kernel stack memory via a uname system call in conjunction with a UNAME26 personality. http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2702b1526c7278c4d65d78de209a465d4de2885e FEDORA-2012-17479 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.16 [oss-security] 20121009 Linux kernel stack memory content leak via UNAME26 USN-1644-1 USN-1645-1 USN-1646-1 USN-1647-1 USN-1648-1 USN-1649-1 USN-1652-1 https://bugzilla.redhat.com/show_bug.cgi?id=862877 https://github.com/torvalds/linux/commit/2702b1526c7278c4d65d78de209a465d4de2885e content/unity-api.js in the unity-firefox-extension extension 2.4.1 for Firefox exposes the toDataURL function in an API call, which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted webpage. http://bazaar.launchpad.net/~webapps/unity-firefox-extension/trunk/revision/331 56930 USN-1665-1 https://bugs.launchpad.net/ubuntu/%2Bsource/unity-firefox-extension/%2Bbug/1069817 Remote Login Service (RLS) 1.0.0 does not properly clear account information when switching users, which might allow physically proximate users to obtain login credentials. USN-1624-1 https://bugs.launchpad.net/remote-login-service/%2Bbug/1070896 remote-login-info-disc(80278) Unity integration extension (unity-firefox-extension) before 2.4.1 for Firefox does not properly handle callbacks, which allows remote attackers to cause a denial of service (Firefox crash) and possibly execute arbitrary code via a crafted request. 56650 USN-1639-1 https://bugs.launchpad.net/unity-firefox-extension/%2Bbug/1076350 unityfirefoxextension-callback-dos(80319) Apt 0.8.16~exp5ubuntu13.x before 0.8.16~exp5ubuntu13.6, 0.8.16~exp12ubuntu10.x before 0.8.16~exp12ubuntu10.7, and 0.9.7.5ubuntu5.x before 0.9.7.5ubuntu5.2, as used in Ubuntu, uses world-readable permissions for /var/log/apt/term.log, which allows local users to obtain sensitive shell information by reading the log file. 56917 USN-1662-1 Aptdaemon 0.43 in Ubuntu 11.10 and 12.04 LTS uses short IDs when importing PPA GPG keys from a keyserver, which allows remote attackers to install arbitrary package repository GPG keys via a man-in-the-middle (MITM) attack. 56959 1027891 USN-1666-1 https://bugs.launchpad.net/software-center-agent/%2Bbug/1052789 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012. Notes: none. Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sCategory parameter to index.php, which is not properly handled by the (1) osc_search_category_id function in oc-includes/osclass/helpers/hSearch.php and (2) findBySlug function oc-includes/osclass/model/Category.php. NOTE: some of these details are obtained from third party information. 20120125 Multiple vulnerabilities in OSclass http://osclass.org/2012/01/16/osclass-2-3-5/ 51662 https://github.com/osclass/OSClass/commit/ff7ef8a97301aaaf6a97fe46c2c27981a86b4e2f#diff-73 https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_osclass.html Multiple cross-site scripting (XSS) vulnerabilities in the getParam function in oc-includes/osclass/core/Params.php in OSClass before 2.3.5 allow remote attackers to inject arbitrary web script or HTML via the (1) sCity, (2) sPattern, (3) sPriceMax, and (4) sPriceMin parameters in a search action to index.php. 20120125 Multiple vulnerabilities in OSclass http://osclass.org/2012/01/16/osclass-2-3-5/ 51662 https://github.com/osclass/OSClass/commit/ff7ef8a97301aaaf6a97fe46c2c27981a86b4e2f#diff-73 https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_osclass.html Cross-site scripting (XSS) vulnerability in misc.php in Image Hosting Script DPI 1.0, 1.3, and earlier allows remote attackers to inject arbitrary web script or HTML via the showseries parameter. http://packetstormsecurity.org/files/view/109240/dpi10-xss.txt 51734 dpi-misc-xss(72823) Cross-site scripting (XSS) vulnerability in admin/EditForm in SilverStripe 2.4.6 allows remote authenticated users with Content Authors privileges to inject arbitrary web script or HTML via the Title parameter. NOTE: some of these details are obtained from third party information. http://doc.silverstripe.org/framework/en/trunk/changelogs/2.3.13 http://doc.silverstripe.org/framework/en/trunk/changelogs/2.4.7 http://packetstormsecurity.org/files/view/109210/silverstripecmspage-xss.txt [oss-security] 20120430 Re: CVE-request: SilverStripe before 2.4.4 51761 silverstripe-editform-xss(72820) https://github.com/silverstripe/sapphire/commit/252e187 https://github.com/silverstripe/sapphire/commit/475e077 https://github.com/silverstripe/sapphire/commit/5fe7091 Stack-based buffer overflow in jp2_x.dll in LuraWave JP2 ActiveX Control 2.1.5.5 and other versions before 2.1.5.11 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment. 51744 lurawave-jp2-qcd-bo(72807) Stack-based buffer overflow in npjp2.dll in LuraWave JP2 Browser Plug-In 1.1.1.11 and other versions before 2.1.1.11 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment. 51732 lurawave-qcd-bo(72806) Cross-site scripting (XSS) vulnerability in TWiki allows remote attackers to inject arbitrary web script or HTML via the organization field in a profile, involving (1) registration or (2) editing of the user. Per: http://secunia.com/advisories/47784 'The vulnerability is confirmed in version 5.1.1. Other versions may also be affected.' http://packetstormsecurity.org/files/109246/twiki-xss.txt http://st2tea.blogspot.com/2012/01/cross-site-scripting-twiki.html 51731 1026604 twiki-organization-xss(72821) SQL injection vulnerability in download.php in phux Download Manager allows remote attackers to execute arbitrary SQL commands via the file parameter. 18432 51725 phux-download-sql-injection(72826) Directory traversal vulnerability in phpShowtime 2.0 allows remote attackers to list arbitrary directories and image files via a .. (dot dot) in the r parameter to index.php. NOTE: Some of these details are obtained from third party information. 18435 phpshowtime-index-directory-traversal(72824) SQL injection vulnerability in search.php in Vastal I-Tech Agent Zone (aka The Real Estate Script) allows remote attackers to execute arbitrary SQL commands via the price_from parameter. 18441 51773 agentzone-search-sql-injection(72879) SQL injection vulnerability in Scriptsez.net Ez Album allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action to index.php. 18438 51781 ezalbum-index-sql-injection(72809) Multiple cross-site scripting (XSS) vulnerabilities in XOOPS before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via the (1) to_userid parameter to modules/pm/pmlite.php or the (2) current_file, (3) imgcat_id, or (4) target parameter to class/xoopseditor/tinymce/tinymce/jscripts/tiny_mce/plugins/xoopsimagemanager/xoopsimagebrowser.php. 20120418 Multiple XSS vulnerabilities in XOOPS http://packetstormsecurity.org/files/111958/XOOPS-2.5.4-Cross-Site-Scripting.html 18753 53143 http://xoops.org/modules/news/article.php?storyid=6284 xoops-pmlite-xoopsimagebrowser-xss(75024) https://www.htbridge.com/advisory/multiple_vulnerabilities_in_xoops.html Multiple buffer overflows in the Wireless Manager ActiveX control 4.0.0.0 in WifiMan.dll in Sony VAIO PC Wireless LAN Wizard 1.0; VAIO Wireless Wizard 1.00, 1.00_64, 1.0.1, 2.0, and 3.0; SmartWi Connection Utility 4.7, 4.7.4, 4.8, 4.9, 4.10, and 4.11; and VAIO Easy Connect software 1.0.0 and 1.1.0 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the second argument of the (1) SetTmpProfileOption or (2) ConnectToNetwork method. 20120530 2 Buffer Overflows in Wireless Manager Sony VAIO http://esupport.sony.com/US/perl/support-info.pl?template_id=1&info_id=946 18958 53735 vaio-activex-bo(75978) Multiple cross-site scripting (XSS) vulnerabilities in ImpressCMS 1.2.x before 1.2.7 Final and 1.3.x before 1.3.1 Final allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) notifications.php, (2) modules/system/admin/images/browser.php, and (3) modules/content/admin/content.php. 20120104 Multiple vulnerabilities in ImpressCMS http://community.impresscms.org/modules/smartsection/item.php?itemid=579 51268 impresscms-multiple-xss(72145) https://www.htbridge.com/advisory/HTB23064 Directory traversal vulnerability in edituser.php in ImpressCMS 1.2.x before 1.2.7 Final and 1.3.x before 1.3.1 Final allows remote authenticated users to include and execute arbitrary local files via a .. (dot dot) in the icmsConfigPlugins[sanitizer_plugins][] parameter. 20120104 Multiple vulnerabilities in ImpressCMS http://community.impresscms.org/modules/smartsection/item.php?itemid=579 51268 impresscms-edituser-file-include(72146) https://www.htbridge.com/advisory/HTB23064 Multiple cross-site scripting (XSS) vulnerabilities in config/dmsDefaults.php in KnowledgeTree 3.7.0.2 and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) login.php, (2) admin.php, or (3) preferences.php. 20120111 Multiple XSS in KnowledgeTree Community Edition http://www.knowledgetree.org/Security_advisory:_URL_Manipulation 51373 knowledgetree-multiple-xss(72308) https://www.htbridge.ch/advisory/multiple_vulnerabilities_in_knowledgetree_community_edition.html Cross-site scripting (XSS) vulnerability in OneOrZero AIMS 2.8.0 Trial Edition build231211 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php. 20120118 XSS in OneOrZero AIMS 51549 oneorzeroaims-index-xss(72456) https://www.htbridge.ch/advisory/xss_in_oneorzero_aims.html Cross-site request forgery (CSRF) vulnerability in admin/settings/update in DClassifieds 0.1 final allows remote attackers to hijack the authentication of administrators for requests that modify account settings such as the administrator password or email via certain Settings[] parameters. 20120125 CSRF (Cross-Site Request Forgery) in DClassifieds http://sourceforge.net/projects/dclassifieds/files/csrf_fix_120105.rar/download 51671 dclassifieds-settings-csrf(72733) https://www.htbridge.ch/advisory/HTB23067 Multiple directory traversal vulnerabilities in OpenEMR 4.1.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the formname parameter to (1) contrib/acog/print_form.php; or (2) load_form.php, (3) view_form.php, or (4) trend_form.php in interface/patient_file/encounter. 20120201 Multiple vulnerabilities in OpenEMR http://www.open-emr.org/wiki/index.php/OpenEMR_Patches 51788 openemr-formname-file-include(72914) https://www.htbridge.ch/advisory/HTB23069 interface/fax/fax_dispatch.php in OpenEMR 4.1.0 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the file parameter. 20120201 Multiple vulnerabilities in OpenEMR http://www.open-emr.org/wiki/index.php/OpenEMR_Patches 51788 openemr-faxdispatch-command-execution(72915) https://www.htbridge.ch/advisory/HTB23069 Eval injection vulnerability in zp-core/zp-extensions/viewer_size_image.php in ZENphoto 1.4.2, when the viewer_size_image plugin is enabled, allows remote attackers to execute arbitrary PHP code via the viewer_size_image_saved cookie. 20120208 Multiple vulnerabilities in ZENphoto 51916 http://www.zenphoto.org/news/zenphoto-1.4.2.1 http://www.zenphoto.org/trac/changeset/8994 http://www.zenphoto.org/trac/changeset/8995 zenphoto-viewersizeimage-code-execution(73081) https://www.htbridge.ch/advisory/HTB23070 SQL injection vulnerability in the Manage Albums feature in zp-core/admin-albumsort.php in ZENphoto 1.4.2 allows remote authenticated users to execute arbitrary SQL commands via the sortableList parameter. 20120208 Multiple vulnerabilities in ZENphoto 51916 http://www.zenphoto.org/news/zenphoto-1.4.2.1 http://www.zenphoto.org/trac/changeset/8994 http://www.zenphoto.org/trac/changeset/8995 zenphoto-albumsort-sql-injection(73082) https://www.htbridge.ch/advisory/HTB23070 Multiple cross-site scripting (XSS) vulnerabilities in ZENphoto 1.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) msg parameter in an external action to zp-core/admin.php, (2) PATH_INTO to an unspecified URL, as demonstrated using /1/, (3) PATH_INFO to zp-core/admin.php, or (4) album parameter to zp-core/admin-edit.php. 20120208 Multiple vulnerabilities in ZENphoto 51916 http://www.zenphoto.org/news/zenphoto-1.4.2.1 http://www.zenphoto.org/trac/changeset/8994 http://www.zenphoto.org/trac/changeset/8995 zenphoto-multiple-xss(73083) https://www.htbridge.ch/advisory/HTB23070 Multiple directory traversal vulnerabilities in 11in1 1.2.1 stable 12-31-2011 allow remote attackers to read arbitrary files via a .. (dot dot) in the class parameter to (1) index.php or (2) admin/index.php. https://www.htbridge.ch/advisory/HTB23071 Cross-site request forgery (CSRF) vulnerability in admin/index.php in 11in1 1.2.1 stable 12-31-2011 allows remote attackers to hijack the authentication of administrators for requests that add new topics via an addTopic action. https://www.htbridge.ch/advisory/HTB23071 Directory traversal vulnerability in account/preferences.php in LEPTON before 1.1.4 allows remote attackers to include and execute arbitrary files via a .. (dot dot) in the language parameter. http://www.lepton-cms.org/media/changelog/changelog_1.1.4.txt http://www.lepton-cms.org/posts/security-release-lepton-1.1.4-52.php https://www.htbridge.ch/advisory/HTB23072 SQL injection vulnerability in modules/news/rss.php in LEPTON before 1.1.4 allows remote attackers to execute arbitrary SQL commands via the group_id parameter. http://www.lepton-cms.org/media/changelog/changelog_1.1.4.txt http://www.lepton-cms.org/posts/security-release-lepton-1.1.4-52.php https://www.htbridge.ch/advisory/HTB23072 Multiple cross-site scripting (XSS) vulnerabilities in LEPTON 1.1.3 and other versions before 1.1.4 allow remote attackers to inject arbitrary web script or HTML via the (1) message parameter to admins/login/forgot/index.php, or the (2) display_name or (3) email parameter to account/preferences.php. http://www.lepton-cms.org/media/changelog/changelog_1.1.4.txt http://www.lepton-cms.org/posts/security-release-lepton-1.1.4-52.php https://www.htbridge.ch/advisory/HTB23072 SQL injection vulnerability in author/edit.php in OpenConf 4.x before 4.12 allows remote attackers to execute arbitrary SQL commands via the pid parameter. 18820 http://www.openconf.com/news/#20120202 51927 openconf-edit-sql-injection(75399) Multiple integer overflows in Opera 11.60 and earlier allow remote attackers to cause a denial of service (application crash) via a large integer argument to the (1) Int32Array, (2) Float32Array, (3) Float64Array, (4) Uint32Array, (5) Int16Array, or (6) ArrayBuffer function. NOTE: the vendor reportedly characterizes this as "a stability issue, not a security issue." http://blog.vulnhunt.com/index.php/2012/02/02/cal-2012-0004-opera-array-integer-overflow/ opera-integer-dos(73027) Multiple cross-site scripting (XSS) vulnerabilities in UI/Register.pm in Foswiki before 1.1.5 allow remote authenticated users with CHANGE privileges to inject arbitrary web script or HTML via the (1) text, (2) FirstName, (3) LastName, (4) OrganisationName, (5) OrganisationUrl, (6) Profession, (7) Country, (8) State, (9) Address, (10) Location, (11) Telephone, (12) VoIP, (13) InstantMessagingIM, (14) Email, (15) HomePage, or (16) Comment parameter. NOTE: some of these details are obtained from third party information. Per: http://foswiki.org/Support/SecurityAlert-CVE-2012-1004 'Vulnerable Software Versions - All versions 1.0.0 - 1.1.4 inclusive for sites that use the user registration process' http://foswiki.org/Support/SecurityAlert-CVE-2012-1004 http://foswiki.org/Tasks/Item11498 http://foswiki.org/Tasks/Item11501 http://st2tea.blogspot.com/2012/02/foswiki-cross-site-scripting.html Multiple cross-site scripting (XSS) vulnerabilities in Sphinx Software Mobile Web Server 3.1.2.47 allow remote attackers to inject arbitrary web script or HTML via the comment parameter to a blog, as demonstrated using (1) Blog/MyFirstBlog.txt or (2) Blog/AboutSomething.txt. http://secpod.org/blog/?p=453 51820 sphinixsoftware-comment-xss(72913) Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) lastName parameter to struts2-showcase/person/editPerson.action, or the (3) clientName parameter to struts2-rest-showcase/orders. http://secpod.org/advisories/SecPod_Apache_Struts_Multiple_Parsistant_XSS_Vulns.txt http://secpod.org/blog/?p=450 51902 apache-struts-multiple-xss(72888) Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter to struts-examples/upload/upload-submit.do, or the message parameter to (2) struts-cookbook/processSimple.do or (3) struts-cookbook/processDyna.do. http://secpod.org/advisories/SecPod_Apache_Struts_Multiple_Parsistant_XSS_Vulns.txt http://secpod.org/blog/?p=450 http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html 51900 apache-struts-name-xss(73052) OfficeSIP Server 3.1 allows remote attackers to cause a denial of service (daemon crash) via a crafted To header in a SIP INVITE message. http://secpod.org/advisories/SecPod_Exploit_OfficeSIP_Server_DOS_Vuln.txt http://secpod.org/blog/?p=461 http://secpod.org/exploits/SecPod_Exploit_OfficeSIP_Server_DOS.py 18453 NetSarang Xlpd 4 Build 0100 and NetSarang Xmanager Enterprise 4 Build 0186 allow remote attackers to cause a denial of service (daemon crash) via a malformed LPD request. http://secpod.org/advisories/SecPod_Exploit_NetSarang_Xlpd_Printer_Daemon_DoS_Vuln.txt http://secpod.org/blog/?p=457 18454 51821 netsarang-xlpd-dos(72933) Unrestricted file upload vulnerability in actions.php in the AllWebMenus plugin before 1.1.8 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory. 20120122 AllWebMenus < 1.1.9 WordPress Menu Plugin Arbitrary file upload http://wordpress.org/extend/plugins/allwebmenus-wordpress-menu-plugin/changelog/ 18407 51615 allwebmenus-actions-file-upload(72640) actions.php in the AllWebMenus plugin 1.1.8 for WordPress allows remote attackers to bypass intended access restrictions to upload and execute arbitrary PHP code by setting the HTTP_REFERER to a certain value, then uploading a ZIP file containing a PHP file, then accessing it via a direct request to the file in an unspecified directory. 20120122 AllWebMenus < 1.1.9 WordPress Menu Plugin Arbitrary file upload http://wordpress.org/extend/plugins/allwebmenus-wordpress-menu-plugin/changelog/ 18407 51615 allwebmenus-actions-file-upload(72640) server/server_stubs.c in the kadmin protocol implementation in MIT Kerberos 5 (aka krb5) 1.10 before 1.10.1 does not properly restrict access to (1) SET_STRING and (2) GET_STRINGS operations, which might allow remote authenticated administrators to modify or read string attributes by leveraging the global list privilege. http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest&pass=guest&id=7093 http://src.mit.edu/fisheye/changelog/krb5/?cs=25704 http://web.mit.edu/kerberos/krb5-1.10/ https://bugzilla.redhat.com/show_bug.cgi?id=796438 The check_1_6_dummy function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.8.x, 1.9.x, and 1.10.x before 1.10.2 allows remote authenticated administrators to cause a denial of service (NULL pointer dereference and daemon crash) via a KRB5_KDB_DISALLOW_ALL_TIX create request that lacks a password. Per: http://cwe.mitre.org/data/definitions/476.html 'CWE-476: NULL Pointer Dereference' http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest&pass=guest&id=7152 [kerberos-announce] 20120531 krb5-1.10.2 is released RHSA-2012:1131 http://web.mit.edu/kerberos/krb5-1.10/ MDVSA-2012:102 53784 https://bugzilla.redhat.com/show_bug.cgi?id=827517 https://github.com/krb5/krb5/commit/c5be6209311d4a8f10fda37d0d3f876c1b33b77b openSUSE-SU-2012:0834 The process_as_req function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.10.x before 1.10.3 does not initialize a certain structure member, which allows remote attackers to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a malformed AS-REQ request. openSUSE-SU-2012:0967 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2012-001.txt DSA-2518 The kdc_handle_protected_negotiation function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8.x, 1.9.x before 1.9.5, and 1.10.x before 1.10.3 attempts to calculate a checksum before verifying that the key type is appropriate for a checksum, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer free, heap memory corruption, and daemon crash) via a crafted AS-REQ request. openSUSE-SU-2012:0967 RHSA-2012:1131 http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2012-001.txt DSA-2518 MDVSA-2012:120 The pkinit_server_return_padata function in plugins/preauth/pkinit/pkinit_srv.c in the PKINIT implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.4 attempts to find an agility KDF identifier in inappropriate circumstances, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted Draft 9 request. http://krbdev.mit.edu/rt/Ticket/Display.html?id=7527 http://web.mit.edu/kerberos/www/krb5-1.10/ https://github.com/krb5/krb5/commit/db64ca25d661a47b996b4e2645998b5d7f0eb52c Multiple SQL injection vulnerabilities in base_qry_main.php in Basic Analysis and Security Engine (BASE) 1.4.5 allow remote attackers to execute arbitrary SQL commands via the (1) ip_addr[0][1], (2) ip_addr[0][2], or (3) ip_addr[0][9] parameters. 18465 51874 base-ipaddr-sql-injection(72998) Cross-site scripting (XSS) vulnerability in includes/convert.php in D-Mack Media Currency Converter (mod_currencyconverter) module 1.0.0 for Joomla! allows remote attackers to inject arbitrary web script or HTML via the from parameter. http://dl.packetstormsecurity.net/1202-exploits/joomlacurrencyconverter-xss.txt 51804 currencyconverter-convert-xss(72917) Multiple cross-site scripting (XSS) vulnerabilities in XWiki Enterprise 3.4 allow remote attackers to inject arbitrary web script or HTML via the (1) XWiki.XWikiComments_comment parameter to xwiki/bin/commentadd/Main/WebHome, (2) XWiki.XWikiUsers_0_company parameter when editing a user profile, or (3) projectVersion parameter to xwiki/bin/view/DownloadCode/DownloadFeedback. NOTE: some of these details are obtained from third party information. http://packetstormsecurity.org/files/109447/XWiki-Enterprise-3.4-Cross-Site-Scripting.html http://st2tea.blogspot.com/2012/02/xwiki-cross-site-scripting.html 51867 Multiple cross-site scripting (XSS) vulnerabilities in login.php in NexorONE Online Banking allow remote attackers to inject arbitrary web script or HTML via the (1) visitor_language parameter to register.php or (2) message parameter. 20120205 NexorONE Online Banking - Multiple Cross Site Vulnerabilities 51876 http://www.vulnerability-lab.com/get_content.php?id=304 nexorone-login-xss(73001) Cross-site scripting (XSS) vulnerability in admin/categories.php in 4images 1.7.10 allows remote attackers to inject arbitrary web script or HTML via the cat_parent_id parameter in an addcat action. http://packetstormsecurity.org/files/109290/4images-xss.txt 51774 4images-categories-xss(72924) SQL injection vulnerability in admin/categories.php in 4images 1.7.10 remote attackers to execute arbitrary SQL commands via the cat_parent_id parameter in an addcat action. http://packetstormsecurity.org/files/109290/4images-xss.txt 51774 4images-catparentid-sql-injection(72932) Open redirect vulnerability in admin/index.php in 4images 1.7.10 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter. http://packetstormsecurity.org/files/109290/4images-xss.txt 51774 4images-index-open-redirect(72925) Directory traversal vulnerability in file in Enigma2 Webinterface 1.5rc1 and 1.5beta4 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. 18343 enigma2-webinterface-directory-traversal(73109) Absolute path traversal vulnerability in file in Enigma2 Webinterface 1.6.0 through 1.6.8, 1.6rc3, and 1.7.0 allows remote attackers to read arbitrary files via a full pathname in the file parameter. 18343 Multiple SQL injection vulnerabilities in login2.php in XRay CMS 1.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameters. 20120212 sqlinjection bug in nova cms http://sourceforge.net/tracker/?func=detail&aid=3488241&group_id=298778&atid=1260461 18467 51870 xraycms-login2-sql-injection(73000) Cross-site scripting (XSS) vulnerability in account-closed.tcl in ]project-open[ (aka ]po[) 3.4.x, 3.5.0.1-2, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the message parameter to register/account-closed. http://dl.packetstormsecurity.net/1202-exploits/projectopen-xss.txt VU#732115 51842 projectopen-accountclosed-xss(72952) Cross-site scripting (XSS) vulnerability in bin/index.php in SimpleGroupware 0.742 and other versions before 0.743 allows remote attackers to inject arbitrary web script or HTML via the export parameter. 20120206 SimpleGroupware 0.742 Cross-Site-Scripting vulnerability http://voxel.dl.sourceforge.net/project/simplgroup/README.md 51882 simple-groupware-index-xss(73042) SQL injection vulnerability in mobile/search/index.php in Tube Ace (Adult PHP Tube Script) 1.6 allows remote attackers to execute arbitrary SQL commands via the q parameter. NOTE: some of these details are obtained from third party information. http://packetstormsecurity.org/files/109485/Tube-Ace-SQL-Injection.html 18466 51873 52046 tubeace-q-sql-injection(72999) Cross-site scripting (XSS) vulnerability in DotNetNuke 6.x through 6.0.2 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted URL containing text that is used within a modal popup. http://technet.microsoft.com/en-us/security/msvr/msvr12-003 http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.62.aspx Unspecified vulnerability in EPiServer CMS 5 and 6 through 6R2, in certain configurations using Forms Authentication, allows remote authenticated users to obtain WebAdmins access by leveraging Edit Mode privileges, a different vulnerability than CVE-2011-3416 and CVE-2011-3417. http://world.episerver.com/Blogs/Jens-N/Dates/2012/1/Security-vulnerability---Elevation-of-privilege/ http://world.episerver.com/Blogs/Shahid-Nawaz/Dates/2012/1/General-Hotfix-CMS-6-R2/ 51877 Cross-site scripting (XSS) vulnerability in the Euroling SiteSeeker module 3.x before 3.4.5 for EPiServer allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. 52874 siteseeker-episerver-xss(74799) The resolver in ISC BIND 9 through 9.8.1-P1 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack. Per: https://www.isc.org/software/bind/advisories/cve-2012-1033 'Solution: On further review, ISC has determined that this is not an issue which needs an immediate patch. The issue is being reviewed at the protocol level and will be addressed there. Implementing DNSSEC is the safest mitigation measure.' SSRT100763 RHSA-2012:0717 VU#542123 51898 1026647 isc-bind-update-sec-bypass(73053) openSUSE-SU-2012:0863 openSUSE-SU-2012:0864 https://www.isc.org/software/bind/advisories/cve-2012-1033 Multiple cross-site scripting (XSS) vulnerabilities in the admin interface in EPiServer CMS through 6R2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://world.episerver.com/Blogs/Shahid-Nawaz/Dates/2012/1/General-Hotfix-CMS-6-R2/ http://world.episerver.com/PageFiles/110367/BugList.txt 51877 AdaCore Ada Web Services (AWS) before 2.10.2 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. 20120127 AdaCore Security Advisory SA-2012-L119-003 Hash collisions in AWS http://www.adacore.com/2012/01/27/security-advisory-sa-2012-l119-003-hash-collisions-in-aws/ http://www.nruns.com/_downloads/advisory28122011.pdf http://www.ocert.org/advisories/ocert-2011-003.html Cross-site scripting (XSS) vulnerability in the telerik HTML editor in DotNetNuke before 5.6.4 and 6.x before 6.1.0 allows remote attackers to inject arbitrary web script or HTML via a message. http://technet.microsoft.com/en-us/security/msvr/msvr12-002 http://www.dotnetnuke.com/News/Security-Policy/Security-bulletin-no.59.aspx PHP remote file inclusion vulnerability in front/popup.php in GLPI 0.78 through 0.80.61 allows remote authenticated users to execute arbitrary PHP code via a URL in the sub_type parameter. 20120210 CVE-2012-1037: GLPI <= 0.80.61 LFI/RFI MDVSA-2012:016 https://forge.indepnet.net/issues/3338 https://forge.indepnet.net/projects/glpi/repository/revisions/17457/diff/branches/0.80-bugfixes/front/popup.php https://forge.indepnet.net/projects/glpi/versions/685 Cross-site scripting (XSS) vulnerability in the WebAAA login functionality (wba_login.html) in Juniper Networks Mobility System Software (MSS) 7.6.x before 7.6.3, 7.7.x before 7.7.1, 7.5.x before 7.5.3, and other unspecified versions before 7.4 and 7.3 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter name. http://www.juniper.net/alerts/viewalert.jsp?actionBtn=Search&txtAlertNumber=PSN-2012-06-611&viewMode=view http://www.secureworks.com/cyber-threat-intelligence/advisories/SWRX-2012-004/ Multiple cross-site scripting (XSS) vulnerabilities in Dotclear before 2.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) login_data parameter to admin/auth.php; (2) nb parameter to admin/blogs.php; (3) type, (4) sortby, (5) order, or (6) status parameters to admin/comments.php; or (7) page parameter to admin/plugin.php. 20120229 Multiple XSS in Dotclear http://dotclear.org/blog/post/2012/02/11/Dotclear-2.4.2 48209 52221 dotclear-multiple-xss(73565) https://www.htbridge.ch/advisory/HTB23074 Cross-site scripting (XSS) vulnerability in TM1 Web in IBM Cognos TM1 9.5.2 FP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0696. 1026648 PM49009 51905 http://www-01.ibm.com/support/docview.wss?crawler=1&uid=swg1PM49009 http://www-01.ibm.com/support/docview.wss?uid=swg27023584 Directory traversal vulnerability in the WWWHELP Service (js/html/wwhelp.htm) in Cyberoam Central Console (CCC) 2.00.2 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the file parameter in an Online_help action. 20120207 Cyberoam Central Console v2.00.2 - File Include Vulnerability 18473 51901 http://www.vulnerability-lab.com/get_content.php?id=405 Cross-site scripting (XSS) vulnerability in communityplusplus/www/administrator.php in eFront Community++ edition 3.6.10, and possibly other editions, allows remote attackers to inject arbitrary web script or HTML via the filter parameter. 20120207 eFronts Community++ v3.6.10 - Cross Site Vulnerability 51894 http://www.vulnerability-lab.com/get_content.php?id=423 efrontcommunity-administrator-xss(73043) Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine ADManager Plus 5.2 Build 5210 allow remote attackers to inject arbitrary web script or HTML via the (1) domainName parameter to jsp/AddDC.jsp or (2) operation parameter to DomainConfig.do. http://packetstormsecurity.org/files/109528 51893 http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5070.php manageengine-admanager-multiple-xss(73039) Directory traversal vulnerability in Mathopd 1.4.x and 1.5.x before 1.5p7, when configured with the * construct for mass virtual hosting, allows remote attackers to read arbitrary files via a crafted Host header. 20120203 Mathopd - Directory Traversal Vulnerability [mathopd] 20120202 security alert: directory traversal when using * in Location http://www.mathopd.org/security.html 1026641 mathopd-http-directory-traversal(73049) Heap-based buffer overflow in Xjp2.dll in the JPEG2000 plug-in in XnView 1.98.5 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment. 51896 xnview-qcd-bo(73040) Buffer overflow in IvanView 1.2.15 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment. 51895 ivanview-qcd-bo(73041) The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups. SUSE-SU-2012:0325 http://projects.puppetlabs.com/issues/12457 http://projects.puppetlabs.com/issues/12458 http://projects.puppetlabs.com/issues/12459 http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14 http://puppetlabs.com/security/cve/cve-2012-1053/ USN-1372-1 DSA-2419 52158 puppet-forked-priv-escalation(73445) openSUSE-SU-2012:0835 Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login. SUSE-SU-2012:0325 http://projects.puppetlabs.com/issues/12460 http://projects.puppetlabs.com/projects/1/wiki/Release_Notes#2.6.14 http://puppetlabs.com/security/cve/cve-2012-1054/ USN-1372-1 DSA-2419 52158 puppet-k5login-type-symlink(73446) openSUSE-SU-2012:0835 Heap-based buffer overflow in PhotoLine 17.01 and possibly other versions before 17.02 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment. 51948 photoline-qcd-bo(73103) The Forward module 6.x-1.x before 6.x-1.21 and 7.x-1.x before 7.x-1.3 for Drupal does not properly enforce permissions for (1) Recent forwards, (2) Most forwarded, or (3) Dynamic blocks, which allows remote attackers to obtain node titles via unspecified vectors. http://drupal.org/node/1423722 http://drupal.org/node/1425150 51826 drupal-multiple-blocks-security-bypass(72920) Cross-site request forgery (CSRF) vulnerability in the clickthrough tracking functionality in the Forward module 6.x-1.x before 6.x-1.21 and 7.x-1.x before 7.x-1.3 for Drupal allows remote attackers to hijack the authentication of administrators for requests that increase node rankings via the tracking code, possibly related to improper "flood control." http://drupal.org/node/1423722 http://drupal.org/node/1425150 http://drupalcode.org/project/forward.git/commitdiff/72158fdbfbf5a068938985e3d10ce1d8f969d9c3 51826 drupal-forward-unspecified-csrf(72922) Cross-site request forgery (CSRF) vulnerability in Flyspray 0.9.9.6 allows remote attackers to hijack the authentication of admins for requests that add admin accounts via an admin.newuser action to index.php. http://packetstormsecurity.org/files/109507/Flyspray-0.9.9.6-Cross-Site-Request-Forgery.html 18468 flyspray-index-csrf(73051) Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Shop/Application/Cart/pages/main.php in OSCommerce Online Merchant 3.0.2 allows remote attackers to inject arbitrary web script or HTML via the value_title parameter, as demonstrated using the "Front" field in the shirt module. http://packetstormsecurity.org/files/109389/VL-407.txt 18455 51831 http://www.vulnerability-lab.com/get_content.php?id=407 oscommerce-index-xss(72916) https://github.com/osCommerce/oscommerce/commit/a5aeb0448cc333cc4b801c0e01981b218fd9c7df Multiple cross-site scripting (XSS) vulnerabilities in revisioning_theme.inc in the Taxonomy module in the Revisioning module 6.x-3.13 and other versions before 6.x-3.14 for Drupal allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via the (1) tags or (2) term parameters. http://drupal.org/node/1431114 http://drupal.org/node/1433550 http://drupalcode.org/project/revisioning.git/commit/768c882 http://www.madirish.net/content/drupal-revisioning-6x-313-xss-vulnerability 51923 SQL injection vulnerability in GForge Advanced Server 6.0.0 and other versions before 6.0.1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. http://gforgegroup.wordpress.com/2012/02/03/gforge-as-6_0_1-release/ 51912 gforgeadvanced-unspecified-sql-injection(73085) Multiple cross-site scripting (XSS) vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to inject arbitrary web script or HTML via the (1) period parameter to showHistoryData.do; (2) selectedNetwork, (3) network, or (4) group parameters to showresource.do; (5) header parameter to AlarmView.do; or (6) attName parameter to jsp/PopUp_Graph.jsp. NOTE: the Search.do/query vector is already covered by CVE-2008-1566, and the jsp/ThresholdActionConfiguration.jsp redirectto vector is already covered by CVE-2008-0474. http://packetstormsecurity.org/files/view/109238/VL-115.txt 51796 http://www.vulnerability-lab.com/get_content.php?id=115 meapplicationsmanager-multiple-xss(72830) Multiple SQL injection vulnerabilities in ManageEngine Applications Manager 9.x and 10.x allow remote attackers to execute arbitrary SQL commands via the (1) viewId parameter to fault/AlarmView.do or (2) period parameter to showHistoryData.do. http://packetstormsecurity.org/files/view/109238/VL-115.txt 51796 http://www.vulnerability-lab.com/get_content.php?id=115 meapplication-multiple-sql-injection(72831) Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Archer SmartSuite Framework 4.x and RSA Archer GRC 5.x before 5.2SP1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. 20130131 ESA-2013-002: RSA Archer GRC Multiple Vulnerabilities Insecure method vulnerability in TuxScripting.dll in the TuxSystem ActiveX control in 2X ApplicationServer 10.1 Build 1224 allows remote attackers to create or overwrite arbitrary files via the ExportSettings method. 51856 2xapplication-activex-file-overwrite(72947) Cross-site scripting (XSS) vulnerability in the template module in SmartyCMS 0.9.4 allows remote attackers to inject arbitrary web script or HTML via the title bar. http://dl.packetstormsecurity.net/1202-exploits/smartycms-xss.txt 51805 smartycms-template-xss(72918) SQL injection vulnerability in the WP-RecentComments plugin 2.0.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in an rc-content action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. 51859 wprecentcomments-index-sql-injection(72951) Cross-site scripting (XSS) vulnerability in the rc_ajax function in core.php in the WP-RecentComments plugin before 2.0.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter, related to AJAX paging. http://plugins.trac.wordpress.org/changeset/416723/wp-recentcomments/trunk/core.php?old=316325&old_path=wp-recentcomments%2Ftrunk%2Fcore.php http://wordpress.org/extend/plugins/wp-recentcomments/changelog/ 49734 wprecentcomments-core-xss(70003) Cross-site scripting (XSS) vulnerability in module/kb/search_word in the search module in lknSupport allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. http://dl.packetstormsecurity.net/1202-exploits/iknsupport-xss.txt 51803 lknsupport-search-xss(72926) Cross-site scripting (XSS) vulnerability in the Modern FAQ (irfaq) extension 1.1.2 and other versions before 1.1.4 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to the "return url parameter." http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2012-001/ 51845 SQL injection vulnerability in the Kitchen recipe (mv_cooking) extension before 0.4.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, as exploited in the wild as of February 2012. http://typo3.org/extensions/repository/view/mv_cooking/0.4.1/ http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2012-001/ 51825 typo3-kitchen-unspecified-sql-injection(72934) SQL injection vulnerability in the Category-System (toi_category) extension 0.6.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2012-001/ 51834 typo3-category-unspecified-sql-injection(72958) Cross-site scripting (XSS) vulnerability in the Category-System (toi_category) extension 0.6.0 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2012-001/ 51834 typo3-categorysystem-unspecified-xss(72957) SQL injection vulnerability in the White Papers (mm_whtppr) extension 0.0.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2012-001/ 51837 typo3-whitepapers-unspecified-sql-injection(72959) SQL injection vulnerability in the Documents download (rtg_files) extension before 1.5.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. http://typo3.org/extensions/repository/view/rtg_files/1.5.2/ http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2012-001/ 51838 typo3-documents-unspecified-sql-injection(72961) Cross-site scripting (XSS) vulnerability in the Documents download (rtg_files) extension before 1.5.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://typo3.org/extensions/repository/view/rtg_files/1.5.2/ http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2012-001/ 51838 typo3-documents-unspecified-xss(72960) SQL injection vulnerability in the Post data records to facebook (bc_post2facebook) extension before 0.2.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. http://typo3.org/extensions/repository/view/bc_post2facebook/0.2.2/ http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2012-001/ The System Utilities (sysutils) extension 1.0.3 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unspecified vectors related to improper "protection" of the "backup output directory." http://typo3.org/extensions/repository/view/sysutils/1.0.4/ http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2012-001/ 51844 typo3-sysutils-unspecified-info-disclosure(72964) Unspecified vulnerability in the Webservices for TYPO3 (typo3_webservice) extension before 0.3.8 for TYPO3 allows remote authenticated users to execute arbitrary code via unknown vectors. http://typo3.org/extensions/repository/view/typo3_webservice/0.3.8/ http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2012-001/ 51843 typo3-webservices-unspecified-code-execution(72965) Cross-site scripting (XSS) vulnerability in the Euro Calculator (skt_eurocalc) extension 0.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2012-001/ 51848 Cross-site scripting (XSS) vulnerability in the Yet another Google search (ya_googlesearch) extension before 0.3.10 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://typo3.org/extensions/repository/view/ya_googlesearch/0.3.10/ http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2012-001/ 51851 Cross-site scripting (XSS) vulnerability in the Terminal PHP Shell (terminal) extension 0.3.2 and earlier for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2012-001/ 51849 Cross-site request forgery (CSRF) vulnerability in the Terminal PHP Shell (terminal) extension 0.3.2 and earlier for TYPO3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2012-001/ 51849 Cross-site scripting (XSS) vulnerability in the BE User Switch (beuserswitch) extension 0.0.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2012-001/ 51852 typo3-beuserswitch-unspecified-xss(72974) Unspecified vulnerability in the BE User Switch (beuserswitch) extension 0.0.1 for TYPO3 allows remote attackers to obtain sensitive information via unknown vectors. http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2012-001/ 51852 typo3-beuserswitch-unspec-info-disclosure(72973) Cross-site scripting (XSS) vulnerability in the UrlTool (aeurltool) extension 0.1.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2012-001/ 51855 Cross-site scripting (XSS) vulnerability in the Post data records to facebook (bc_post2facebook) extension before 0.2.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://typo3.org/extensions/repository/view/bc_post2facebook/0.2.2/ http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2012-001/ iproute2 before 3.3.0 allows local users to overwrite arbitrary files via a symlink attack on a temporary file used by (1) configure or (2) examples/dhcp-client-script. http://git.kernel.org/?p=linux/kernel/git/shemminger/iproute2.git;a=commit;h=20ed7b24df05eadf83168d1d0ce0052a31380928 http://git.kernel.org/?p=linux/kernel/git/shemminger/iproute2.git;a=commit;h=e557d1ac3a156ba7521ba44b0b412af4542f83f8 HPSBGN02970 https://bugzilla.redhat.com/show_bug.cgi?id=797878 Directory traversal vulnerability in Apache Wicket 1.4.x before 1.4.20 and 1.5.x before 1.5.5 allows remote attackers to read arbitrary web-application files via a relative pathname in a URL for a Wicket resource that corresponds to a null package. 80301 http://wicket.apache.org/2012/03/22/wicket-cve-2012-1089.html 52679 apache-wicket-dir-traversal(74276) The cifs_lookup function in fs/cifs/dir.c in the Linux kernel before 3.2.10 allows local users to cause a denial of service (OOPS) via attempted access to a special file, as demonstrated by a FIFO. SUSE-SU-2012:0554 SUSE-SU-2012:0616 RHSA-2012:0481 RHSA-2012:0531 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.10 [oss-security] 20120228 Re: CVE request -- kernel: cifs: dentry refcount leak when opening a FIFO on lookup leads to panic on unmount https://bugzilla.redhat.com/show_bug.cgi?id=798293 https://github.com/torvalds/linux/commit/88d7d4e4a439f32acc56a6d860e415ee71d3df08 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-1410. Reason: This candidate is a reservation duplicate of CVE-2012-1410. Notes: All CVE users should reference CVE-2012-1410 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-1410. Reason: This candidate is a reservation duplicate of CVE-2012-1410. Notes: All CVE users should reference CVE-2012-1410 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. osc before 0.134 might allow remote OBS repository servers or package maintainers to execute arbitrary commands via a crafted (1) build log or (2) build status that contains an escape sequence for a terminal emulator. openSUSE-SU-2012:0400 [oss-security] 20120228 Re: CVE Request (minor) -- osc: Improper sanitization of terminal emulator escape sequences when displaying build log and build status [oss-security] 20120228 CVE Request (minor) -- osc: Improper sanitization of terminal emulator escape sequences when displaying build log and build status [oss-security] 20120301 Re: Re: CVE Request (minor) -- osc: Improper sanitization of terminal emulator escape sequences when displaying build log and build status https://bugzilla.novell.com/show_bug.cgi?id=749335 https://bugzilla.redhat.com/show_bug.cgi?id=798353 The regset (aka register set) feature in the Linux kernel before 3.2.10 does not properly handle the absence of .get and .set methods, which allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a (1) PTRACE_GETREGSET or (2) PTRACE_SETREGSET ptrace call. http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c8e252586f8d5de906385d8cf6385fee289a825e SUSE-SU-2012:0554 SUSE-SU-2012:0616 RHSA-2012:0481 RHSA-2012:0531 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.10 [oss-security] 20120305 CVE-2012-1097 kernel: regset: Prevent null pointer reference on readonly regsets https://bugzilla.redhat.com/show_bug.cgi?id=799209 https://github.com/torvalds/linux/commit/c8e252586f8d5de906385d8cf6385fee289a825e Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving a SafeBuffer object that is manipulated through certain methods. [rubyonrails-security] 20120301 Possible XSS Security Vulnerability in SafeBuffer#[] FEDORA-2012-3321 http://weblog.rubyonrails.org/2012/3/1/ann-rails-3-0-12-has-been-released [oss-security] 20120302 CVE Request -- Ruby on Rails (v3.0.12) / rubygem-actionpack: Two XSS flaws [oss-security] 20120302 Re: CVE Request -- Ruby on Rails (v3.0.12) / rubygem-actionpack: Two XSS flaws https://bugzilla.redhat.com/show_bug.cgi?id=799275 Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_options_helper.rb in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving certain generation of OPTION elements within SELECT elements. [rubyonrails-security] 20120301 XSS Vulnerability in the select helper FEDORA-2012-3321 FEDORA-2012-3355 http://weblog.rubyonrails.org/2012/3/1/ann-rails-3-0-12-has-been-released DSA-2466 [oss-security] 20120302 CVE Request -- Ruby on Rails (v3.0.12) / rubygem-actionpack: Two XSS flaws [oss-security] 20120302 Re: CVE Request -- Ruby on Rails (v3.0.12) / rubygem-actionpack: Two XSS flaws https://bugzilla.redhat.com/show_bug.cgi?id=799276 Red Hat JBoss Operations Network (JON) 3.0.x before 3.0.1, 2.4.2, and earlier, when LDAP authentication is enabled and the LDAP bind account credentials are invalid, allows remote attackers to login to LDAP-based accounts via an arbitrary password in a login request. RHSA-2012:0396 RHSA-2012:0406 https://bugzilla.redhat.com/show_bug.cgi?id=799789 emacs/notmuch-mua.el in Notmuch before 0.11.1, when using the Emacs interface, allows user-assisted remote attackers to read arbitrary files via crafted MML tags, which are not properly quoted in an email reply cna cause the files to be attached to the message. http://git.notmuchmail.org/git/notmuch/blobdiff/3f2050ac221a4c940c12442f156f12fff11600c6..ae438ccd8c77831158c7c30f19710d798ee4a6b4:/emacs/notmuch-mua.el http://notmuchmail.org/news/release-0.11.1/ DSA-2416 [oss-security] 20120304 CVE request: notmuch [oss-security] 20120304 Re: CVE request: notmuch 52155 The C handler plug-in in Automatic Bug Reporting Tool (ABRT), possibly 2.0.8 and earlier, does not properly set the group (GID) permissions on core dump files for setuid programs when the sysctl fs.suid_dumpable option is set to 2, which allows local users to obtain sensitive information. RHSA-2012:0841 54121 abrt-info-disc(76524) https://fedorahosted.org/abrt/changeset/23d6997d7886abe118c28254f7f73f0b19b2d4e0 The analyzeCurrent function in ape/apeproperties.cpp in TagLib 1.7 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a crafted sampleRate in an ape file, which triggers a divide-by-zero error. [pipermail] 20120304 multiple security vulnerabilities in taglib [pipermail] 20120304 multiple security vulnerabilities in taglib GLSA-201206-16 [oss-security] 20120305 Re: CVE-Request taglib vulnerabilities 52284 taglib-analyzecurrent-dos(73666) https://github.com/taglib/taglib/commit/77d61c6eca4d08b9b025738acf6b926cc750db23 The parse function in ogg/xiphcomment.cpp in TagLib 1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted vendorLength field in an ogg file. [pipermail] 20120304 multiple security vulnerabilities in taglib [pipermail] 20120305 multiple security vulnerabilities in taglib GLSA-201206-16 [oss-security] 20120305 Re: CVE-Request taglib vulnerabilities 52284 taglib-parse-dos(73665) https://github.com/taglib/taglib/commit/b3646a07348ffa276ea41a9dae03ddc63ea6c532 Multiple cross-site scripting (XSS) vulnerabilities in Etano 1.22 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) user, (2) email, (3) email2, (4) f17_zip, or (5) agree parameter to join.php; (6) PATH_INFO, (7) st, (8) f17_city, (9) f17_country, (10) f17_state, (11) f17_zip, (12) f19, (13) wphoto, (14) search, or (15) v parameter to search.php; (16) PATH_INFO or (17) st parameter to photo_search.php; or (18) return parameter to photo_view.php. 20120305 Etano 1.x <= Multiple Cross Site Scripting Vulnerabilities [oss-security] 20120306 Etano 1.x <= Multiple Cross Site Scripting Vulnerabilities [oss-security] 20120305 Re: Etano 1.x <= Multiple Cross Site Scripting Vulnerabilities 52295 http://yehg.net/lab/pr0js/advisories/%5Betano_1.2.x%5D_xss etano-multiple-xss(73669) lightdm before 1.0.9 does not properly close file descriptors before opening a child process, which allows local users to write to the lightdm log or have other unspecified impact. openSUSE-SU-2012:0354 [oss-security] 20120305 CVE Request: lightdm [oss-security] 20120305 Re: CVE Request: lightdm https://bugs.launchpad.net/ubuntu/+source/lightdm/+bug/927060 https://bugzilla.novell.com/show_bug.cgi?id=745339 Directory traversal vulnerability in Open-Realty CMS 2.5.8 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the select_users_template parameter to index.php. 20120305 Open-Realty CMS 2.5.8 (2.x.x) <= "select_users_template" Local File Inclusion Vulnerability [oss-security] 20120306 Open-Realty CMS 2.5.8 (2.x.x) <= "select_users_template" Local File Inclusion Vulnerability [oss-security] 20120305 Re: Open-Realty CMS 2.5.8 (2.x.x) <= "select_users_template" Local File Inclusion Vulnerability 52296 http://yehg.net/lab/pr0js/advisories/%5Bopen-realty_2.5.8_2.x%5D_lfi openrealty-selectuserstemplate-file-include(73736) Multiple cross-site scripting (XSS) vulnerabilities in the administration subsystem in Gallery 2 before 2.3.2 and 3 before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://gallery.menalto.com/gallery_3_0_3_and_gallery_2_3_2 FEDORA-2012-5777 FEDORA-2012-5787 FEDORA-2012-5806 FEDORA-2012-5814 FEDORA-2012-5832 FEDORA-2012-5822 52996 https://bugzilla.redhat.com/show_bug.cgi?id=812045 gallery-unspec-xss(74837) SQL injection vulnerability in Joomla! 1.7.x and 2.5.x before 2.5.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. http://developer.joomla.org/security/news/391-20120301-core-sql-injection.html [oss-security] 20120306 Re: CVE-request: Joomla! Security News 2012-03 [oss-security] 20120306 CVE-request: Joomla! Security News 2012-03 52312 joomla-unspecified-param-sql-injection(73699) Cross-site scripting (XSS) vulnerability in Joomla! 2.5.0 and 2.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://developer.joomla.org/security/news/392-20120302-core-xss-vulnerability.html [oss-security] 20120306 Re: CVE-request: Joomla! Security News 2012-03 [oss-security] 20120306 CVE-request: Joomla! Security News 2012-03 52314 joomla-unspecified-param-xss(73700) The access_has_bug_level function in core/access_api.php in MantisBT before 1.2.9 does not properly restrict access when the private_bug_view_threshold is set to an array, which allows remote attackers to bypass intended restrictions and perform certain operations on private bug reports. FEDORA-2012-18273 FEDORA-2012-18299 FEDORA-2012-18294 GLSA-201211-01 DSA-2500 http://www.mantisbt.org/bugs/changelog_page.php?version_id=140 http://www.mantisbt.org/bugs/view.php?id=10124 [oss-security] 20120306 Re: CVE request: mantisbt before 1.2.9 52313 https://github.com/mantisbt/mantisbt/commit/eb803ed02105fc919cf5f789e939f2b824162927 MantisBT before 1.2.9 does not audit when users copy or clone a bug report, which makes it easier for remote attackers to copy bug reports without detection. FEDORA-2012-18273 FEDORA-2012-18299 FEDORA-2012-18294 GLSA-201211-01 DSA-2500 http://www.mantisbt.org/bugs/changelog_page.php?version_id=140 http://www.mantisbt.org/bugs/view.php?id=13816 [oss-security] 20120306 Re: CVE request: mantisbt before 1.2.9 52313 https://github.com/mantisbt/mantisbt/commit/cf5df427f17cf9204645f83e000665780eb9afe6 https://github.com/mantisbt/mantisbt/commit/dea7e315f3fc96dfa995e56e8810845fc07a47aa The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnote_allow_user_edit_delete and delete_bug_threshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes. FEDORA-2012-18273 FEDORA-2012-18299 FEDORA-2012-18294 GLSA-201211-01 DSA-2500 http://www.mantisbt.org/bugs/changelog_page.php?version_id=140 http://www.mantisbt.org/bugs/view.php?id=13656 [oss-security] 20120306 Re: CVE request: mantisbt before 1.2.9 52313 https://github.com/mantisbt/mantisbt/commit/df7782a65e96aa1c9639a7625a658102134c7fe0 MantisBT before 1.2.9 does not properly check permissions, which allows remote authenticated users with manager privileges to (1) modify or (2) delete global categories. FEDORA-2012-18273 FEDORA-2012-18299 FEDORA-2012-18294 GLSA-201211-01 http://www.mantisbt.org/bugs/changelog_page.php?version_id=140 http://www.mantisbt.org/bugs/view.php?id=13561 [oss-security] 20120306 Re: CVE request: mantisbt before 1.2.9 52313 https://github.com/mantisbt/mantisbt/commit/9443258724e84cb388aa1865b775beaecd80596d bug_actiongroup.php in MantisBT before 1.2.9 does not properly check the report_bug_threshold permission of the receiving project when moving a bug report, which allows remote authenticated users with the report_bug_threshold and move_bug_threshold privileges for a project to bypass intended access restrictions and move bug reports to a different project. FEDORA-2012-18273 FEDORA-2012-18299 FEDORA-2012-18294 GLSA-201211-01 DSA-2500 http://www.mantisbt.org/bugs/changelog_page.php?version_id=140 http://www.mantisbt.org/bugs/view.php?id=13748 [oss-security] 20120306 Re: CVE request: mantisbt before 1.2.9 52313 https://github.com/mantisbt/mantisbt/commit/0da3f7ace233208eb3c8d628cc2fd6e56d83839f The mci_check_login function in api/soap/mc_api.php in the SOAP API in MantisBT before 1.2.9 allows remote attackers to bypass authentication via a null password. FEDORA-2012-18273 FEDORA-2012-18299 FEDORA-2012-18294 GLSA-201211-01 DSA-2500 http://www.mantisbt.org/bugs/changelog_page.php?version_id=140 http://www.mantisbt.org/bugs/view.php?id=13901 [oss-security] 20120306 Re: CVE request: mantisbt before 1.2.9 52313 https://github.com/mantisbt/mantisbt/commit/f5106be52cf6aa72c521f388e4abb5f0de1f1d7f Unrestricted file upload vulnerability in uploadify/scripts/uploadify.php in the Kish Guest Posting plugin before 1.2 for WordPress allows remote attackers to execute arbitrary code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the directory specified by the folder parameter. Per: http://cwe.mitre.org/data/definitions/434.html 'CWE-434: Unrestricted Upload of File with Dangerous Type' 20120123 Wordpress Kish Guest Posting Plugin 1.0 (uploadify.php) Unrestricted File Upload Vulnerability http://plugins.svn.wordpress.org/kish-guest-posting/trunk/readme.txt http://plugins.trac.wordpress.org/changeset/403694/kish-guest-posting/trunk/uploadify/scripts/uploadify.php 18412 [oss-security] 20120306 Re: CVE-request: Kish Guest Posting Plugin for WordPress File Upload Remote PHP Code Execution [oss-security] 20120306 CVE-request: Kish Guest Posting Plugin for WordPress File Upload Remote PHP Code Execution [oss-security] 20120308 Re: CVE-request: Kish Guest Posting Plugin for WordPress File Upload Remote PHP Code Execution 51638 wp-kishguest-uploadify-file-upload(79563) FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via crafted property data in a BDF font. APPLE-SA-2012-09-19-1 SUSE-SU-2012:0483 SUSE-SU-2012:0484 openSUSE-SU-2012:0489 SUSE-SU-2012:0521 RHSA-2012:0467 48508 GLSA-201204-04 http://support.apple.com/kb/HT5503 MDVSA-2012:057 http://www.mozilla.org/security/announce/2012/mfsa2012-21.html [oss-security] 20120306 Re: CVE Request -- FreeType: Multiple security flaws to be fixed in v2.4.9 52318 1026765 USN-1403-1 https://bugzilla.mozilla.org/show_bug.cgi?id=733512 https://bugzilla.redhat.com/show_bug.cgi?id=800581 FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via crafted glyph or bitmap data in a BDF font. APPLE-SA-2012-09-19-1 SUSE-SU-2012:0483 SUSE-SU-2012:0484 openSUSE-SU-2012:0489 SUSE-SU-2012:0521 RHSA-2012:0467 48508 GLSA-201204-04 http://support.apple.com/kb/HT5503 MDVSA-2012:057 http://www.mozilla.org/security/announce/2012/mfsa2012-21.html [oss-security] 20120306 Re: CVE Request -- FreeType: Multiple security flaws to be fixed in v2.4.9 52318 1026765 USN-1403-1 https://bugzilla.mozilla.org/show_bug.cgi?id=733512 https://bugzilla.redhat.com/show_bug.cgi?id=800583 FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and memory corruption) or possibly execute arbitrary code via a crafted TrueType font. APPLE-SA-2012-09-19-1 SUSE-SU-2012:0484 openSUSE-SU-2012:0489 48508 GLSA-201204-04 http://support.apple.com/kb/HT5503 MDVSA-2012:057 http://www.mozilla.org/security/announce/2012/mfsa2012-21.html [oss-security] 20120306 Re: CVE Request -- FreeType: Multiple security flaws to be fixed in v2.4.9 52318 1026765 USN-1403-1 https://bugzilla.mozilla.org/show_bug.cgi?id=733512 https://bugzilla.redhat.com/show_bug.cgi?id=800584 FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via a crafted SFNT string in a Type 42 font. APPLE-SA-2012-09-19-1 SUSE-SU-2012:0483 SUSE-SU-2012:0484 openSUSE-SU-2012:0489 SUSE-SU-2012:0521 48508 GLSA-201204-04 http://support.apple.com/kb/HT5503 MDVSA-2012:057 http://www.mozilla.org/security/announce/2012/mfsa2012-21.html [oss-security] 20120306 Re: CVE Request -- FreeType: Multiple security flaws to be fixed in v2.4.9 52318 1026765 USN-1403-1 https://bugzilla.mozilla.org/show_bug.cgi?id=733512 https://bugzilla.redhat.com/show_bug.cgi?id=800585 FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via crafted property data in a PCF font. APPLE-SA-2012-09-19-1 SUSE-SU-2012:0483 SUSE-SU-2012:0484 openSUSE-SU-2012:0489 SUSE-SU-2012:0521 RHSA-2012:0467 48508 GLSA-201204-04 http://support.apple.com/kb/HT5503 MDVSA-2012:057 http://www.mozilla.org/security/announce/2012/mfsa2012-21.html [oss-security] 20120306 Re: CVE Request -- FreeType: Multiple security flaws to be fixed in v2.4.9 52318 1026765 USN-1403-1 https://bugzilla.mozilla.org/show_bug.cgi?id=733512 https://bugzilla.redhat.com/show_bug.cgi?id=800587 FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, on 64-bit platforms allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via vectors related to the cell table of a font. APPLE-SA-2012-09-19-1 SUSE-SU-2012:0483 SUSE-SU-2012:0484 openSUSE-SU-2012:0489 SUSE-SU-2012:0521 RHSA-2012:0467 48508 GLSA-201204-04 http://support.apple.com/kb/HT5503 MDVSA-2012:057 http://www.mozilla.org/security/announce/2012/mfsa2012-21.html [oss-security] 20120306 Re: CVE Request -- FreeType: Multiple security flaws to be fixed in v2.4.9 52318 1026765 USN-1403-1 https://bugzilla.mozilla.org/show_bug.cgi?id=733512 https://bugzilla.redhat.com/show_bug.cgi?id=800589 FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via crafted dictionary data in a Type 1 font. APPLE-SA-2012-09-19-1 SUSE-SU-2012:0483 SUSE-SU-2012:0484 openSUSE-SU-2012:0489 SUSE-SU-2012:0521 RHSA-2012:0467 48508 GLSA-201204-04 http://support.apple.com/kb/HT5503 MDVSA-2012:057 http://www.mozilla.org/security/announce/2012/mfsa2012-21.html [oss-security] 20120306 Re: CVE Request -- FreeType: Multiple security flaws to be fixed in v2.4.9 52318 1026765 USN-1403-1 https://bugzilla.mozilla.org/show_bug.cgi?id=733512 https://bugzilla.redhat.com/show_bug.cgi?id=800590 FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and memory corruption) or possibly execute arbitrary code via crafted glyph or bitmap data in a BDF font. APPLE-SA-2012-09-19-1 SUSE-SU-2012:0483 SUSE-SU-2012:0484 openSUSE-SU-2012:0489 SUSE-SU-2012:0521 48300 48508 GLSA-201204-04 http://support.apple.com/kb/HT5503 DSA-2428 MDVSA-2012:057 http://www.mozilla.org/security/announce/2012/mfsa2012-21.html [oss-security] 20120306 Re: CVE Request -- FreeType: Multiple security flaws to be fixed in v2.4.9 52318 1026765 USN-1403-1 https://bugzilla.mozilla.org/show_bug.cgi?id=733512 https://bugzilla.redhat.com/show_bug.cgi?id=800591 FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and memory corruption) or possibly execute arbitrary code via crafted private-dictionary data in a Type 1 font. APPLE-SA-2012-09-19-1 SUSE-SU-2012:0483 SUSE-SU-2012:0484 openSUSE-SU-2012:0489 SUSE-SU-2012:0521 RHSA-2012:0467 48300 48508 GLSA-201204-04 http://support.apple.com/kb/HT5503 DSA-2428 MDVSA-2012:057 http://www.mozilla.org/security/announce/2012/mfsa2012-21.html [oss-security] 20120306 Re: CVE Request -- FreeType: Multiple security flaws to be fixed in v2.4.9 52318 1026765 USN-1403-1 https://bugzilla.mozilla.org/show_bug.cgi?id=733512 https://bugzilla.redhat.com/show_bug.cgi?id=800592 FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via vectors involving the NPUSHB and NPUSHW instructions in a TrueType font. APPLE-SA-2012-09-19-1 SUSE-SU-2012:0483 SUSE-SU-2012:0484 openSUSE-SU-2012:0489 SUSE-SU-2012:0521 48508 GLSA-201204-04 http://support.apple.com/kb/HT5503 MDVSA-2012:057 http://www.mozilla.org/security/announce/2012/mfsa2012-21.html [oss-security] 20120306 Re: CVE Request -- FreeType: Multiple security flaws to be fixed in v2.4.9 52318 1026765 USN-1403-1 https://bugzilla.mozilla.org/show_bug.cgi?id=733512 https://bugzilla.redhat.com/show_bug.cgi?id=800593 FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and memory corruption) or possibly execute arbitrary code via crafted glyph or bitmap data in a BDF font that lacks an ENCODING field. APPLE-SA-2012-09-19-1 SUSE-SU-2012:0483 SUSE-SU-2012:0484 openSUSE-SU-2012:0489 SUSE-SU-2012:0521 RHSA-2012:0467 48300 48508 GLSA-201204-04 http://support.apple.com/kb/HT5503 DSA-2428 MDVSA-2012:057 http://www.mozilla.org/security/announce/2012/mfsa2012-21.html [oss-security] 20120306 Re: CVE Request -- FreeType: Multiple security flaws to be fixed in v2.4.9 52318 1026765 USN-1403-1 https://bugzilla.mozilla.org/show_bug.cgi?id=733512 https://bugzilla.redhat.com/show_bug.cgi?id=800594 FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via a crafted header in a BDF font. APPLE-SA-2012-09-19-1 SUSE-SU-2012:0483 SUSE-SU-2012:0484 openSUSE-SU-2012:0489 RHSA-2012:0467 48508 GLSA-201204-04 http://support.apple.com/kb/HT5503 MDVSA-2012:057 http://www.mozilla.org/security/announce/2012/mfsa2012-21.html [oss-security] 20120306 Re: CVE Request -- FreeType: Multiple security flaws to be fixed in v2.4.9 52318 1026765 USN-1403-1 https://bugzilla.mozilla.org/show_bug.cgi?id=733512 https://bugzilla.redhat.com/show_bug.cgi?id=800595 FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via vectors involving the MIRP instruction in a TrueType font. APPLE-SA-2012-09-19-1 SUSE-SU-2012:0483 SUSE-SU-2012:0484 openSUSE-SU-2012:0489 SUSE-SU-2012:0521 48508 GLSA-201204-04 http://support.apple.com/kb/HT5503 MDVSA-2012:057 http://www.mozilla.org/security/announce/2012/mfsa2012-21.html [oss-security] 20120306 Re: CVE Request -- FreeType: Multiple security flaws to be fixed in v2.4.9 52318 1026765 USN-1403-1 https://bugzilla.mozilla.org/show_bug.cgi?id=733512 https://bugzilla.redhat.com/show_bug.cgi?id=800597 Array index error in FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid stack read operation and memory corruption) or possibly execute arbitrary code via crafted glyph data in a BDF font. APPLE-SA-2012-09-19-1 SUSE-SU-2012:0483 SUSE-SU-2012:0484 openSUSE-SU-2012:0489 SUSE-SU-2012:0521 RHSA-2012:0467 48508 GLSA-201204-04 http://support.apple.com/kb/HT5503 MDVSA-2012:057 http://www.mozilla.org/security/announce/2012/mfsa2012-21.html [oss-security] 20120306 Re: CVE Request -- FreeType: Multiple security flaws to be fixed in v2.4.9 52318 1026765 USN-1403-1 https://bugzilla.mozilla.org/show_bug.cgi?id=733512 https://bugzilla.redhat.com/show_bug.cgi?id=800598 FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via a crafted PostScript font object. APPLE-SA-2012-09-19-1 SUSE-SU-2012:0484 openSUSE-SU-2012:0489 RHSA-2012:0467 48508 GLSA-201204-04 http://support.apple.com/kb/HT5503 MDVSA-2012:057 http://www.mozilla.org/security/announce/2012/mfsa2012-21.html [oss-security] 20120306 Re: CVE Request -- FreeType: Multiple security flaws to be fixed in v2.4.9 52318 1026765 USN-1403-1 https://bugzilla.mozilla.org/show_bug.cgi?id=733512 https://bugzilla.redhat.com/show_bug.cgi?id=800600 FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via a crafted ASCII string in a BDF font. APPLE-SA-2012-09-19-1 SUSE-SU-2012:0483 SUSE-SU-2012:0484 openSUSE-SU-2012:0489 SUSE-SU-2012:0521 RHSA-2012:0467 48508 GLSA-201204-04 http://support.apple.com/kb/HT5503 MDVSA-2012:057 http://www.mozilla.org/security/announce/2012/mfsa2012-21.html [oss-security] 20120306 Re: CVE Request -- FreeType: Multiple security flaws to be fixed in v2.4.9 52318 1026765 USN-1403-1 https://bugzilla.mozilla.org/show_bug.cgi?id=733512 https://bugzilla.redhat.com/show_bug.cgi?id=800602 FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and memory corruption) or possibly execute arbitrary code via crafted glyph-outline data in a font. APPLE-SA-2012-09-19-1 SUSE-SU-2012:0483 SUSE-SU-2012:0484 openSUSE-SU-2012:0489 SUSE-SU-2012:0521 RHSA-2012:0467 48300 48508 GLSA-201204-04 http://support.apple.com/kb/HT5503 DSA-2428 MDVSA-2012:057 http://www.mozilla.org/security/announce/2012/mfsa2012-21.html [oss-security] 20120306 Re: CVE Request -- FreeType: Multiple security flaws to be fixed in v2.4.9 52318 1026765 USN-1403-1 https://bugzilla.mozilla.org/show_bug.cgi?id=733512 https://bugzilla.redhat.com/show_bug.cgi?id=800604 FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (divide-by-zero error) via a crafted font. APPLE-SA-2012-09-19-1 SUSE-SU-2012:0483 SUSE-SU-2012:0484 openSUSE-SU-2012:0489 SUSE-SU-2012:0521 RHSA-2012:0467 48508 GLSA-201204-04 http://support.apple.com/kb/HT5503 MDVSA-2012:057 http://www.mozilla.org/security/announce/2012/mfsa2012-21.html [oss-security] 20120306 Re: CVE Request -- FreeType: Multiple security flaws to be fixed in v2.4.9 52318 1026765 USN-1403-1 https://bugzilla.mozilla.org/show_bug.cgi?id=733512 https://bugzilla.redhat.com/show_bug.cgi?id=800606 FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and memory corruption) or possibly execute arbitrary code via a crafted TrueType font. APPLE-SA-2012-09-19-1 SUSE-SU-2012:0484 openSUSE-SU-2012:0489 RHSA-2012:0467 48300 48508 GLSA-201204-04 http://support.apple.com/kb/HT5503 DSA-2428 MDVSA-2012:057 http://www.mozilla.org/security/announce/2012/mfsa2012-21.html [oss-security] 20120306 Re: CVE Request -- FreeType: Multiple security flaws to be fixed in v2.4.9 52318 1026765 USN-1403-1 https://bugzilla.mozilla.org/show_bug.cgi?id=733512 https://bugzilla.redhat.com/show_bug.cgi?id=800607 spacewalk-backend in Red Hat Network Satellite 5.4 on Red Hat Enterprise Linux 6 does not properly authorize or authenticate uploads to the NULL organization when mod_wsgi is used, which allows remote attackers to cause a denial of service (/var partition disk consumption and failed updates) via a large number of package uploads. RHSA-2012:0436 52832 1026873 network-satellite-null-sec-bypass(74498) The mem_cgroup_usage_unregister_event function in mm/memcontrol.c in the Linux kernel before 3.2.10 does not properly handle multiple events that are attached to the same eventfd, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by registering memory threshold events. http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=371528caec553785c37f73fa3926ea0de84f986f FEDORA-2012-3712 SUSE-SU-2012:0554 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.10 [oss-security] 20120307 Re: CVE request -- kernel: mm: memcg: unregistring of events attached to the same eventfd can lead to oops https://bugzilla.redhat.com/show_bug.cgi?id=800813 kernel-memcg-dos(73711) https://github.com/torvalds/linux/commit/371528caec553785c37f73fa3926ea0de84f986f readfilemap.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (file descriptor consumption) via a large number of crafted XML files. http://expat.cvs.sourceforge.net/viewvc/expat/expat/xmlwf/readfilemap.c?r1=1.14&r2=1.15 APPLE-SA-2015-12-08-3 http://sourceforge.net/projects/expat/files/expat/2.1.0/ http://sourceforge.net/tracker/?func=detail&aid=2895533&group_id=10127&atid=110127 http://trac.wxwidgets.org/ticket/11194 http://trac.wxwidgets.org/ticket/11432 52379 1034344 https://support.apple.com/HT205637 Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities. http://expat.cvs.sourceforge.net/viewvc/expat/expat/lib/xmlparse.c?r1=1.166&r2=1.167 APPLE-SA-2015-12-08-3 RHSA-2012:0731 RHSA-2016:0062 RHSA-2016:2957 http://sourceforge.net/projects/expat/files/expat/2.1.0/ http://sourceforge.net/tracker/?func=detail&atid=110127&aid=2958794&group_id=10127 DSA-2525 MDVSA-2012:041 52379 1034344 USN-1527-1 USN-1613-1 USN-1613-2 https://support.apple.com/HT205637 Integer overflow in the vclmi.dll module in OpenOffice.org (OOo) 3.3, 3.4 Beta, and possibly earlier, and LibreOffice before 3.5.3, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted embedded image object, as demonstrated by a JPEG image in a .DOC file, which triggers a heap-based buffer overflow. 20120516 CVE-2012-1149 OpenOffice.org integer overflow error in vclmi.dll module when allocating memory for an embedded image object FEDORA-2012-8114 FEDORA-2012-8042 RHSA-2012:0705 GLSA-201209-05 1027068 DSA-2473 DSA-2487 GLSA-201408-19 http://www.libreoffice.org/advisories/cve-2012-1149/ MDVSA-2012:090 MDVSA-2012:091 http://www.openoffice.org/security/cves/CVE-2012-1149.html 53570 openoffice-vclmi-bo(75692) Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. http://bugs.python.org/issue13703 APPLE-SA-2013-10-22-3 [python-dev] 20111229 Hash collision security issue (now public) [python-dev] 20120128 plugging the hash attack http://python.org/download/releases/2.6.8/ http://python.org/download/releases/2.7.3/ http://python.org/download/releases/3.1.5/ http://python.org/download/releases/3.2.3/ [oss-security] 20120309 Re: CVE Request: Python Hash DoS (Issue 13703) USN-1592-1 USN-1596-1 USN-1615-1 USN-1616-1 https://bugzilla.redhat.com/show_bug.cgi?id=750555 Multiple format string vulnerabilities in dbdimp.c in DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module before 2.19.0 for Perl allow remote PostgreSQL database servers to cause a denial of service (process crash) via format string specifiers in (1) a crafted database warning to the pg_warn function or (2) a crafted DBD statement to the dbd_st_prepare function. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=661536 http://cpansearch.perl.org/src/TURNSTEP/DBD-Pg-2.19.1/Changes RHSA-2012:1116 GLSA-201204-08 DSA-2431 MDVSA-2012:112 [oss-security] 20120309 CVE Request -- libdbd-pg-perl / perl-DBD-Pg && libyaml-libyaml-perl / perl-YAML-LibYAML: Multiple format string flaws [oss-security] 20120309 Re: CVE Request -- libdbd-pg-perl / perl-DBD-Pg && libyaml-libyaml-perl / perl-YAML-LibYAML: Multiple format string flaws https://bugzilla.redhat.com/show_bug.cgi?id=801733 dbdpg-pgwarn-format-string(73854) dbdpg-dbdstprepare-format-string(73855) https://rt.cpan.org/Public/Bug/Display.html?id=75642 Multiple format string vulnerabilities in the error reporting functionality in the YAML::LibYAML (aka YAML-LibYAML and perl-YAML-LibYAML) module 0.38 for Perl allow remote attackers to cause a denial of service (process crash) via format string specifiers in a (1) YAML stream to the Load function, (2) YAML node to the load_node function, (3) YAML mapping to the load_mapping function, or (4) YAML sequence to the load_sequence function. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=661548 FEDORA-2012-4997 FEDORA-2012-5035 FEDORA-2012-4871 openSUSE-SU-2012:1000 openSUSE-SU-2015:0319 DSA-2432 [oss-security] 20120309 CVE Request -- libdbd-pg-perl / perl-DBD-Pg && libyaml-libyaml-perl / perl-YAML-LibYAML: Multiple format string flaws [oss-security] 20120309 Re: CVE Request -- libdbd-pg-perl / perl-DBD-Pg && libyaml-libyaml-perl / perl-YAML-LibYAML: Multiple format string flaws 52381 https://bugzilla.redhat.com/show_bug.cgi?id=801738 yaml-load-format-string(73856) https://rt.cpan.org/Public/Bug/Display.html?id=46507 https://rt.cpan.org/Public/Bug/Display.html?id=75365 Unrestricted file upload vulnerability in addons/uploadify/uploadify.php in appRain CMF 0.1.5 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the uploads directory. Per: http://cwe.mitre.org/data/definitions/434.html 'CWE-434: Unrestricted Upload of File with Dangerous Type' 20120119 appRain CMF <= 0.1.5 (uploadify.php) Unrestricted File Upload Vulnerability 18392 18922 [oss-security] 20120309 CVE-request: appRain CMF uploadify.php File Upload Remote PHP Code Execution [oss-security] 20120309 Re: CVE-request: appRain CMF uploadify.php File Upload Remote PHP Code Execution 51576 appraincmf-uploadify-file-upload(72466) mod_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application Platform 5.1.2, when "ROOT" is set to excludedContexts, exposes the root context of the server, which allows remote attackers to bypass access restrictions and gain access to applications deployed on the root context via unspecified vectors. RHSA-2012:1010 RHSA-2012:1011 RHSA-2012:1012 RHSA-2012:1052 RHSA-2012:1053 RHSA-2012:1166 https://bugzilla.redhat.com/show_bug.cgi?id=802200 https://community.jboss.org/message/624018 https://issues.jboss.org/browse/MODCLUSTER-253 Heap-based buffer overflow in the _zip_readcdir function in zip_open.c in libzip 0.10 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a zip archive with the number of directories set to 0, related to an "incorrect loop construct." [libzip-discuss] 20120320 libzip-0.10.1 security fix release GLSA-201203-23 MDVSA-2012:034 http://www.nih.at/libzip/NEWS.html [oss-security] 20120321 CVE-2012-1162 / -1163: Incorrect loop construct and numeric overflow in libzip [oss-security] 20120329 Re: CVE-2012-1162 / -1163: Incorrect loop construct and numeric overflow in libzip Integer overflow in the _zip_readcdir function in zip_open.c in libzip 0.10 allows remote attackers to execute arbitrary code via the size and offset values for the central directory in a zip archive, which triggers "improper restrictions of operations within the bounds of a memory buffer" and an information leak. [libzip-discuss] 20120320 libzip-0.10.1 security fix release GLSA-201203-23 MDVSA-2012:034 http://www.nih.at/libzip/NEWS.html [oss-security] 20120321 CVE-2012-1162 / -1163: Incorrect loop construct and numeric overflow in libzip [oss-security] 20120329 Re: CVE-2012-1162 / -1163: Incorrect loop construct and numeric overflow in libzip slapd in OpenLDAP before 2.4.30 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an LDAP search query with attrsOnly set to true, which causes empty attributes to be returned. RHSA-2012:0899 GLSA-201406-36 MDVSA-2012:130 http://www.openldap.org/its/index.cgi/Software%20Bugs?id=7143 http://www.openldap.org/software/release/changes.html 52404 The mime_param_cmp function in crypto/asn1/asn_mime.c in OpenSSL before 0.9.8u and 1.x before 1.0.0h allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted S/MIME message, a different vulnerability than CVE-2006-7250. http://cvs.openssl.org/chngview?cn=22252 SSRT100877 FEDORA-2012-4665 FEDORA-2012-4659 FEDORA-2012-4630 FEDORA-2012-18035 SSRT100844 SSRT100891 RHSA-2012:0426 RHSA-2012:0488 RHSA-2012:0531 RHSA-2012:1306 RHSA-2012:1307 RHSA-2012:1308 48580 DSA-2454 [oss-security] 20120312 Re: CVE request: openssl: null pointer dereference issue [oss-security] 20120312 Re: CVE request: openssl: null pointer dereference issue [oss-security] 20120312 Re: CVE request: openssl: null pointer dereference issue [oss-security] 20120312 Re: CVE request: openssl: null pointer dereference issue 52764 1026787 USN-1424-1 https://downloads.avaya.com/css/P8/documents/100162507 The default keybindings for wwm in LTSP Display Manager (ldm) 2.2.x before 2.2.7 allow remote attackers to execute arbitrary commands via the KP_RETURN keybinding, which launches a terminal window. http://irclogs.ltsp.org/?d=2012-03-12 USN-1398-1 https://bugs.launchpad.net/ubuntu/%2Bsource/ldm/%2Bbug/953340 The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to true on the JBossWebRealm, does not properly check the permissions created by the WebPermissionMapping class, which allows remote authenticated users to access arbitrary applications. RHSA-2012:1013 RHSA-2012:1014 RHSA-2012:1026 RHSA-2012:1027 RHSA-2012:1028 RHSA-2012:1125 RHSA-2012:1232 1027501 54089 https://bugzilla.redhat.com/show_bug.cgi?id=802622 jboss-jacc-security-bypass(76680) The libxml RSHUTDOWN function in PHP 5.x allows remote attackers to bypass the open_basedir protection mechanism and read arbitrary files via vectors involving a stream_close method call during use of a custom stream wrapper. https://bugs.php.net/bug.php?id=61367 https://bugzilla.redhat.com/show_bug.cgi?id=802591 https://github.com/php/php-src/blob/master/ext/libxml/tests/bug61367-read.phpt https://github.com/php/php-src/blob/master/ext/libxml/tests/bug61367-write.phpt The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid [ (open square bracket) characters in name values, which makes it easier for remote attackers to cause a denial of service (malformed $_FILES indexes) or conduct directory traversal attacks during multi-file uploads by leveraging a script that lacks its own filename restrictions. http://isisblogs.poly.edu/2011/08/11/php-not-properly-checking-params/ APPLE-SA-2012-09-19-2 FEDORA-2012-6911 FEDORA-2012-6907 FEDORA-2012-6869 SUSE-SU-2012:0598 SUSE-SU-2012:0604 SSRT100856 [oss-security] 20120313 Re: CVE request for PHP 5.3.x Corrupted $_FILES indices lead to security concern http://support.apple.com/kb/HT5501 http://svn.php.net/viewvc/php/php-src/branches/PHP_5_4/main/rfc1867.c?r1=321664&r2=321663&pathrev=321664 http://svn.php.net/viewvc?view=revision&revision=321664 DSA-2465 http://www.php.net/ChangeLog-5.php#5.4.0 https://bugs.php.net/bug.php?id=48597 https://bugs.php.net/bug.php?id=49683 https://bugs.php.net/bug.php?id=54374 https://bugs.php.net/bug.php?id=55500 https://nealpoole.com/blog/2011/10/directory-traversal-via-php-multi-file-uploads/ https://students.mimuw.edu.pl/~ai292615/php_multipleupload_overwrite.pdf Multiple integer overflows in tiff_getimage.c in LibTIFF 3.9.4 allow remote attackers to execute arbitrary code via a crafted tile size in a TIFF file, which is not properly handled by the (1) gtTileSeparate or (2) gtStripSeparate function, leading to a heap-based buffer overflow. http://bugzilla.maptools.org/attachment.cgi?id=477&action=diff http://bugzilla.maptools.org/show_bug.cgi?id=2369 http://home.gdal.org/private/zdi-can-1221/zdi-can-1221.txt APPLE-SA-2012-09-19-1 APPLE-SA-2012-09-19-2 FEDORA-2012-5463 FEDORA-2012-5406 FEDORA-2012-5410 RHSA-2012:0468 GLSA-201209-02 http://support.apple.com/kb/HT5501 http://support.apple.com/kb/HT5503 USN-1416-1 DSA-2447 MDVSA-2012:054 52891 1026895 https://downloads.avaya.com/css/P8/documents/100161772 libtiff-gttileseparate-bo(74656) openSUSE-SU-2012:0539 The rm_rf_children function in util.c in the systemd-logind login manager in systemd before 44, when logging out, allows local users to delete arbitrary files via a symlink attack on unspecified files, related to "particular records related with user session." http://cgit.freedesktop.org/systemd/systemd/commit/?id=5ebff5337594d690b322078c512eb222d34aaa82 FEDORA-2012-6456 MDVSA-2012:030 [oss-security] 20120316 [Notification] CVE-2012-1174 systemd: TOCTOU race condition by removing user session https://bugzilla.redhat.com/show_bug.cgi?id=803358 Integer overflow in the GnashImage::size method in libbase/GnashImage.h in GNU Gnash 0.8.10 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SWF file, which triggers a heap-based buffer overflow. http://git.savannah.gnu.org/cgit/gnash.git/commit/?id=bb4dc77eecb6ed1b967e3ecbce3dac6c5e6f1527 DSA-2435 [oss-security] 20120314 CVE request: gnash integer overflow [oss-security] 20120314 Re: CVE request: gnash integer overflow 52446 https://bugzilla.redhat.com/show_bug.cgi?id=803443 Buffer overflow in the fribidi_utf8_to_unicode function in PyFriBidi before 0.11.0 allows remote attackers to cause a denial of service (application crash) via a 4-byte utf-8 sequence. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=663189 http://groups.google.com/group/linux.debian.bugs.dist/browse_thread/thread/aacd036037217998/8d095f85f3665bff?lnk=raot FEDORA-2012-3513 FEDORA-2012-3537 FEDORA-2012-3549 [oss-security] 20120314 CVE request: pyfribidi buffer overflow flaw [oss-security] 20120314 Re: CVE request: pyfribidi buffer overflow flaw 52451 https://bugzilla.redhat.com/show_bug.cgi?id=801896 https://bugzilla.wikimedia.org/show_bug.cgi?id=35055 fribidi-utf8-bo(74001) https://github.com/pediapress/pyfribidi/commit/d2860c655357975e7b32d84e6b45e98f0dcecd7a https://github.com/pediapress/pyfribidi/issues/2%29: libgdata before 0.10.2 and 0.11.x before 0.11.1 does not validate SSL certificates, which allows remote attackers to obtain user names and passwords via a man-in-the-middle (MITM) attack with a spoofed certificate. http://git.gnome.org/browse/libgdata/commit/?h=libgdata-0-10&id=8eff8fa9138859e03e58c2aa76600ab63eb5c29c http://git.gnome.org/browse/libgdata/commit/?id=6799f2c525a584dc998821a6ce897e463dad7840 DSA-2482 MDVSA-2012:111 [oss-security] 20120314 CVE Request: libgdata did not verify SSL certificates [oss-security] 20120314 Re: CVE Request: libgdata did not verify SSL certificates [oss-security] 20120314 Re: CVE Request: libgdata did not verify SSL certificates USN-1547-1 https://bugs.launchpad.net/ubuntu/+source/libgdata/+bug/938812 https://bugzilla.gnome.org/show_bug.cgi?id=671535 https://bugzilla.novell.com/show_bug.cgi?id=752088 The msn_oim_report_to_user function in oim.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.2 allows remote servers to cause a denial of service (application crash) via an OIM message that lacks UTF-8 encoding. http://developer.pidgin.im/ticket/14884 http://developer.pidgin.im/viewmtn/revision/diff/60f8379d0a610538cf42e0dd9ab1436c8b9308cd/with/3053d6a37cc6d8774aba7607b992a4408216adcd/libpurple/protocols/msn/oim.c http://developer.pidgin.im/viewmtn/revision/info/3053d6a37cc6d8774aba7607b992a4408216adcd http://pidgin.im/news/security/?id=61 RHSA-2012:1102 MDVSA-2012:029 52475 oval:org.mitre.oval:def:18019 The Linux kernel before 3.3.1, when KVM is used, allows guest OS users to cause a denial of service (host OS crash) by leveraging administrative access to the guest OS, related to the pmd_none_or_clear_bad function and page faults for huge pages. FEDORA-2012-3712 SUSE-SU-2012:0554 HPSBGN02970 RHSA-2012:0743 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.3.1 [oss-security] 20120315 CVE-2012-1179 kernel: thp: __split_huge_page() mapcount != page_mapcount BUG_ON() 1027084 https://bugzilla.redhat.com/show_bug.cgi?id=803793 https://github.com/torvalds/linux/commit/4a1d704194a441bf83c636004a479e01360ec850 Use-after-free vulnerability in nginx before 1.0.14 and 1.1.x before 1.1.17 allows remote HTTP servers to obtain sensitive information from process memory via a crafted backend response, in conjunction with a client request. FEDORA-2012-3846 FEDORA-2012-3991 FEDORA-2012-4006 http://nginx.org/download/patch.2012.memory.txt http://nginx.org/en/security_advisories.html 20120315 nginx fix for malformed HTTP responses from upstream servers GLSA-201203-22 http://trac.nginx.org/nginx/changeset/4530/nginx http://trac.nginx.org/nginx/changeset/4531/nginx DSA-2434 MDVSA-2012:043 [oss-security] 20120315 CVE Request: nginx fix for malformed HTTP responses from upstream servers [oss-security] 20120315 Re: CVE Request: nginx fix for malformed HTTP responses from upstream servers 52578 1026827 https://bugzilla.redhat.com/show_bug.cgi?id=803856 nginx-ngxcpystrn-info-disclosure(74191) openSUSE-SU-2012:0469 fcgid_spawn_ctl.c in the mod_fcgid module 2.3.6 for the Apache HTTP Server does not recognize the FcgidMaxProcessesPerClass directive for a virtual host, which makes it easier for remote attackers to cause a denial of service (memory consumption) via a series of HTTP requests that triggers a process count higher than the intended limit. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=615814 DSA-2436 [oss-security] 20120315 CVE-request: apache's mod-fcgid does not respect configured FcgidMaxProcessesPerClass in VirtualHost [oss-security] 20120315 Re: CVE-request: apache's mod-fcgid does not respect configured FcgidMaxProcessesPerClass in VirtualHost 52565 apache-modfcgid-dos(74181) https://issues.apache.org/bugzilla/show_bug.cgi?id=49902 The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers to execute arbitrary code via a crafted RPC call. APPLE-SA-2012-05-09-1 FEDORA-2012-5843 FEDORA-2012-5793 FEDORA-2012-5805 FEDORA-2012-6382 SUSE-SU-2012:0501 SUSE-SU-2012:0502 SUSE-SU-2012:0504 SUSE-SU-2012:0515 SSRT100872 SSRT100824 http://support.apple.com/kb/HT5281 http://www.collax.com/produkte/AllinOne-server-for-small-businesses#id2565578 DSA-2450 MDVSA-2012:055 http://www.samba.org/samba/history/samba-3.6.4.html 1026913 USN-1423-1 https://www.samba.org/samba/security/CVE-2012-1182 Stack-based buffer overflow in the milliwatt_generate function in the Miliwatt application in Asterisk 1.4.x before 1.4.44, 1.6.x before 1.6.2.23, 1.8.x before 1.8.10.1, and 10.x before 10.2.1, when the o option is used and the internal_timing option is off, allows remote attackers to cause a denial of service (application crash) via a large number of samples in an audio packet. 20120315 AST-2012-002: Remote Crash Vulnerability in Milliwatt Application http://downloads.asterisk.org/pub/security/AST-2012-002.pdf http://downloads.asterisk.org/pub/security/AST-2012-002-1.8.diff 1026812 http://www.asterisk.org/node/51797 DSA-2460 [oss-security] 20120316 CVE Request -- Asterisk: AST-2012-002 and AST-2012-003 flaws [oss-security] 20120316 Re: CVE Request -- Asterisk: AST-2012-002 and AST-2012-003 flaws 52523 asterisk-milliwattgenerate-dos(74082) Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x before 10.2.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string in an HTTP Digest Authentication header. http://downloads.asterisk.org/pub/security/AST-2012-003.pdf http://downloads.asterisk.org/pub/security/AST-2012-003-1.8.diff http://www.asterisk.org/node/51797 [oss-security] 20120316 CVE Request -- Asterisk: AST-2012-002 and AST-2012-003 flaws [oss-security] 20120316 Re: CVE Request -- Asterisk: AST-2012-002 and AST-2012-003 flaws 1026813 asterisk-astparsedigest-bo(74083) Multiple integer overflows in (1) magick/profile.c or (2) magick/property.c in ImageMagick 6.7.5 and earlier allow remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted offset value in the ResolutionUnit tag in the EXIF IFD0 of an image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0247. openSUSE-SU-2012:0692 http://trac.imagemagick.org/changeset/6998/ImageMagick/branches/ImageMagick-6.7.5/magick/profile.c http://trac.imagemagick.org/changeset/6998/ImageMagick/branches/ImageMagick-6.7.5/magick/property.c USN-1435-1 DSA-2462 [oss-security] 20120319 CVE-2012-1185 / CVE-2012-1186 assignment notification - incomplete ImageMagick fixes for CVE-2012-0247 / CVE-2012-0248 51957 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1185 imagemagick-profile-code-execution(76140) Integer overflow in the SyncImageProfiles function in profile.c in ImageMagick 6.7.5-8 and earlier allows remote attackers to cause a denial of service (infinite loop) via crafted IOP tag offsets in the IFD in an image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0248. openSUSE-SU-2012:0692 http://trac.imagemagick.org/changeset/6998/ImageMagick/branches/ImageMagick-6.7.5/magick/profile.c USN-1435-1 DSA-2462 [oss-security] 20120319 Subject: CVE-2012-1185 / CVE-2012-1186 assignment notification - incomplete ImageMagick fixes for CVE-2012-0247 / CVE-2012-0248 51957 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1186 imagemagick-syncimageprofiles-dos(76139) Multiple cross-site scripting (XSS) vulnerabilities in Fork CMS before 3.2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) type or (2) querystring parameters to private/en/error or (3) name parameter to private/en/locale/index. 20120307 Multiple XSS in Fork CMS http://www.fork-cms.com/blog/detail/fork-cms-3-2-7-released 52236 forkcms-index-xss(73605) https://github.com/forkcms/forkcms/commit/1269fe8b3813c7b7d5552a2b88bc2e7bd4d0c1f9 https://github.com/forkcms/forkcms/commit/995220182068518e89019a265d113518f6566407 https://www.htbridge.ch/advisory/HTB23075 Stack-based buffer overflow in modules/graphic/ssgraph/grsound.cpp in The Open Racing Car Simulator (TORCS) before 1.3.3 and Speed Dreams allows user-assisted remote attackers to execute arbitrary code via a long file name in an engine sample attribute in an xml configuration file. http://freecode.com/projects/torcs/releases/341672 http://torcs.sourceforge.net/index.php?name=News&file=article&sid=79 18471 [oss-security] 20120218 TORCS 1.3.2 xml buffer overflow - CVE-2012-1189 [oss-security] 20120305 Re: TORCS 1.3.2 xml buffer overflow - CVE-2012-1189 Cross-site scripting (XSS) vulnerability in the replication-setup functionality in js/replication.js in phpMyAdmin 3.4.x before 3.4.10.1 allows user-assisted remote attackers to inject arbitrary web script or HTML via a crafted database name. FEDORA-2012-5631 FEDORA-2012-5624 FEDORA-2012-5599 MDVSA-2012:050 http://www.phpmyadmin.net/home_page/security/PMASA-2012-1.php 52857 phpmyadmin-replication-xss(75304) https://github.com/phpmyadmin/phpmyadmin/commit/86073d532aed656550cb731aa5b4288b126ae7a6 The resolver in dnscache in Daniel J. Bernstein djbdns 1.05 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack. https://www.isc.org/files/imce/ghostdomain_camera.pdf The resolver in Unbound before 1.4.11 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack. https://www.isc.org/files/imce/ghostdomain_camera.pdf The resolver in PowerDNS Recursor (aka pdns_recursor) 3.3 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack. FEDORA-2013-5692 FEDORA-2013-6316 FEDORA-2013-6279 https://www.isc.org/files/imce/ghostdomain_camera.pdf The resolver in the DNS Server service in Microsoft Windows Server 2008 before R2 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack. https://www.isc.org/files/imce/ghostdomain_camera.pdf Unrestricted file upload vulnerability in andesk/managementsuite/core/core.anonymous/ServerSetup.asmx in the ServerSetup web service in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension via a PutUpdateFileCore command in a RunAMTCommand SOAP request, then accessing the file via a direct request to the file in the web root. 52023 1026693 thinkmanagement-serversetup-file-upload(73207) Directory traversal vulnerability in the VulCore web service (WSVulnerabilityCore/VulCore.asmx) in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to delete arbitrary files via a .. (dot dot) in the filename parameter in a SetTaskLogByFile SOAP request. 52023 1026693 thinkmanagement-vulcore-dir-traversal(73208) Integer overflow in the IDE_ACDStd.apl module for ACDSee 14.1 Build 137 allows remote attackers to execute arbitrary code via crafted "image dimension values" in a BMP file, which triggers a heap-based buffer overflow. 52047 acdsee-bmp-image-bo(73242) base_ag_main.php in Basic Analysis and Security Engine (BASE) 1.4.5 allows remote attackers to execute arbitrary code by uploading contents of the file with an executable extension via a create action, then accessing it via a view action. http://packetstormsecurity.org/files/109663/BASE-1.4.5-Remote-File-Inclusion-Shell-Creation.html 51979 base-baseagmain-security-bypass(73201) Multiple PHP remote file inclusion vulnerabilities in Basic Analysis and Security Engine (BASE) 1.4.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) BASE_path parameter to base_ag_main.php, (2) base_db_setup.php, (3) base_graph_common.php, (4) base_graph_display.php, (5) base_graph_form.php, (6) base_graph_main.php, (7) base_local_rules.php, (8) base_logout.php, (9) base_main.php, (10) base_maintenance.php, (11) base_payload.php, (12) base_qry_alert.php, (13) base_qry_common.php, (14) base_qry_main.php, (15) base_stat_alerts.php, (16) base_stat_class.php, (17) base_stat_common.php, (18) base_stat_ipaddr.php, (19) base_stat_iplink.php, (20) base_stat_ports.php, (21) base_stat_sensor.php, (22) base_stat_time.php, (23) base_stat_uaddr.php, (24) base_user.php, (25) index.php, (26) admin/base_roleadmin.php, (27) admin/base_useradmin.php, (28) admin/index.php, (29) help/base_setup_help.php, (30) includes/base_action.inc.php, (31) includes/base_cache.inc.php, (32) includes/base_db.inc.php, (33) includes/base_db.inc.php, (34) includes/base_include.inc.php, (35) includes/base_output_html.inc.php, (36) includes/base_output_query.inc.php, (37) includes/base_state_criteria.inc.php, (38) includes/base_state_query.inc.php or (39) setup/base_conf_contents.php; (40) GLOBALS[user_session_path] parameter to includes/base_state_common.inc.php; (41) BASE_Language parameter to setup/base_conf_contents.php; or (42) ado_inc_php parameter to setup/setup2.php. http://packetstormsecurity.org/files/109663/BASE-1.4.5-Remote-File-Inclusion-Shell-Creation.html 51979 base-multiple-file-include(73200) Multiple PHP remote file inclusion vulnerabilities in Nova CMS allow remote attackers to execute arbitrary PHP code via a URL in the (1) fileType parameter to optimizer/index.php, (2) id parameter to administrator/modules/moduleslist.php, (3) filename parameter to includes/function/gets.php, or (4) conf[blockfile] parameter to includes/function/usertpl.php. http://packetstormsecurity.org/files/109669/Nova-CMS-Remote-File-Inclusion.html 51976 novacms-multiple-file-include(73159) Cross-site request forgery (CSRF) vulnerability in starnet/index.php in SyndeoCMS 3.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that add user accounts via a save_user action. 18498 PHP remote file inclusion vulnerability in relocate-upload.php in Relocate Upload plugin before 0.20 for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter. http://plugins.trac.wordpress.org/changeset/504380/relocate-upload http://wordpress.org/extend/plugins/relocate-upload/changelog/ 49693 Multiple integer overflows in Hancom Office 2010 SE 8.5.5 allow remote attackers to execute arbitrary code via large dimension values in a (1) JPG image to the ImportGR in the JPG image filter module (HncJpeg10.flt) or (2) PNG image to the PNG image filter module (HncPng10.flt), which triggers a heap-based buffer overflow. http://www.hancom.co.kr/notice.noticeView.do?targetRow=1&notice_seqno=100 51892 hancom-importgr-bo(73025) hancom-png-bo(73026) Directory traversal vulnerability in frontend/core/engine/javascript.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the module parameter to frontend/js.php. http://packetstormsecurity.org/files/109709/Fork-CMS-3.2.4-Cross-Site-Scripting-Local-File-Inclusion.html http://www.fork-cms.com/blog/detail/fork-cms-3-2-5-released 51972 forkcms-js-file-include(73169) https://github.com/forkcms/forkcms/commit/a9986b86c53de0582248b39605660fbba0c21a29 Multiple cross-site scripting (XSS) vulnerabilities in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allow remote attackers to inject arbitrary web script or HTML via the (1) report parameter to blog/settings or (2) error parameter to users/index. http://packetstormsecurity.org/files/109709/Fork-CMS-3.2.4-Cross-Site-Scripting-Local-File-Inclusion.html http://www.fork-cms.com/blog/detail/fork-cms-3-2-5-released 51972 https://github.com/forkcms/forkcms/commit/8fa74dd3e2e32723cd121177dce6aeac37e29df6 https://github.com/forkcms/forkcms/commit/d65c083adc91c88d21bd9a0df4c2688df634c6ff https://github.com/forkcms/forkcms/commit/df75e0797a6540c4d656969a2e7df7689603b2cf Cross-site scripting (XSS) vulnerability in backend/core/engine/base.php in Fork CMS 3.2.4 and possibly other versions before 3.2.5 allows remote attackers to inject arbitrary web script or HTML via the highlight parameter. http://www.fork-cms.com/blog/detail/fork-cms-3-2-5-released forkcms-base-xss(73393) https://github.com/forkcms/forkcms/commit/c8ec9c58a6b3c46cdd924532c1de99bcda6072ed https://github.com/forkcms/forkcms/commit/df75e0797a6540c4d656969a2e7df7689603b2cf SQL injection vulnerability in pfile/file.php in Powie pFile 1.02 allows remote attackers to execute arbitrary SQL commands via the id parameter. http://packetstormsecurity.org/files/109670/Pfile-1.02-Cross-Site-Scripting-SQL-Injection.html 51982 pfile-file-sql-injection(73166) Cross-site scripting (XSS) vulnerability in pfile/kommentar.php in Powie pFile 1.02 allows remote attackers to inject arbitrary web script or HTML via the filecat parameter. http://packetstormsecurity.org/files/109670/Pfile-1.02-Cross-Site-Scripting-SQL-Injection.html 51982 pfile-kommentar-xss(73165) Cross-site scripting (XSS) vulnerability in the smwfOnSfSetTargetName function in extensions/SMWHalo/includes/SMW_Initialize.php in Semantic Enterprise Wiki (SMW+) 1.5.6, 1.6.0_2 and earlier allows remote attackers to inject arbitrary web script or HTML via the target parameter to index.php/Special:FormEdit. NOTE: some of these details are obtained from third party information. http://packetstormsecurity.org/files/109637/SMW-1.5.6-Cross-Site-Scripting.html http://st2tea.blogspot.com/2012/02/smw-enterprise-wiki-156-cross-site.html 51980 smw-target-xss(73167) Cross-site scripting (XSS) vulnerability in zimbra/h/calendar in Zimbra Web Client in Zimbra Collaboration Suite (ZCS) 6.x before 6.0.15 and 7.x before 7.1.3 allows remote attackers to inject arbitrary web script or HTML via the view parameter. http://packetstormsecurity.org/files/109710/Zimbra-Cross-Site-Scripting.html http://st2tea.blogspot.com/2012/02/zimbra-cross-site-scripting.html 51974 https://bugzilla.zimbra.com/show_bug.cgi?id=63849 zimbra-view-xss(73168) Cross-site scripting (XSS) vulnerability in the Add friends module in Yoono Desktop Application before 1.8.21 allows remote attackers to inject arbitrary web script or HTML via the create field in a "Create a group" action. http://packetstormsecurity.org/files/109618/#comment-10343 http://packetstormsecurity.org/files/109618/Yoono-Desktop-1.8.16-Cross-Site-Scripting.html http://support.yoono.com/yoono/topics/xss-w35in yoono-addfriends-xss(73149) Cross-site scripting (XSS) vulnerability in the Add friends module in the Yoono extension before 7.7.8 for Firefox allows remote attackers to inject arbitrary web script or HTML via the create field in a "Create a group" action. http://packetstormsecurity.org/files/109617/#comment-10344 http://packetstormsecurity.org/files/109617/Yoono-Firefox-7.7.0-Cross-Site-Scripting.html http://support.yoono.com/yoono/topics/xss-w35in 51970 yoonofirefoxextension-addfriends-xss(73150) Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in PBBoard 2.1.4 allow remote attackers to hijack the authentication of administrators for requests that (1) upload a file via an add action or (2) change the contents of a file via a dit action. http://packetstormsecurity.org/files/109706/PBBoard-2.1.4-Cross-Site-Request-Forgery-Shell-Upload.html Multiple cross-site scripting (XSS) vulnerabilities in STHS v2 Web Portal 2.2 allow remote attackers to inject arbitrary web script or HTML via the team parameter to (1) prospects.php, (2) prospect.php, or (3) team.php. http://0nto.wordpress.com/2012/02/13/sths-v2-web-portal-2-2-sql-injection-vulnerabilty/ http://packetstormsecurity.org/files/109665/STHS-v2-Web-Portal-2.2-SQL-Injection.html 51991 sths-prospects-team-sql-injection(73154) Multiple SQL injection vulnerabilities in freelancerKit 2.35 allow remote attackers to execute arbitrary SQL commands via unspecified vectors to the (1) notes and (2) tickets components. 51946 http://www.vulnerability-lab.com/get_content.php?id=402 freelancerkit-multiple-sql-injection(73105) Multiple cross-site scripting (XSS) vulnerabilities in freelancerKit 2.35 allow remote attackers to inject arbitrary web script or HTML via the (1) ticket parameter to tickets.php, (2) title parameter to notes.php, or (3) task parameter to todo.php. NOTE: some of these details are obtained from third party information. 51946 http://www.vulnerability-lab.com/get_content.php?id=402 freelancerkit-multiple-xss(73104) Cross-site request forgery (CSRF) vulnerability in modules/config/admin_utente.php in GAzie 5.20 and earlier allows remote attackers to hijack the authentication of administrators for requests that change account information via an update action, as demonstrated by changing the password. 18464 gazie-adminutente-csrf(72991) Directory traversal vulnerability in the telnet server in RabidHamster R2/Extreme 1.65 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the File command. http://aluigi.org/adv/r2_1-adv.txt 52061 r2-file-dir-traversal(73114) Stack-based buffer overflow in RabidHamster R2/Extreme 1.65 and earlier allows remote authenticated users to execute arbitrary code via a long string to TCP port 23. http://aluigi.org/adv/r2_1-adv.txt 52061 r2-file-bo(73113) RabidHamster R2/Extreme 1.65 and earlier uses a small search space of values for the PIN number, which allows remote attackers to obtain the PIN number via a brute force attack. http://aluigi.org/adv/r2_1-adv.txt r2-telnet-unauth-access(73115) Cross-site scripting (XSS) vulnerability in system/classes/login.php in ContentLion Alpha 1.3 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO. http://www.darksecurity.de/advisories/2012/SSCHADV2012-004.txt Multiple SQL injection vulnerabilities in Dolibarr CMS 3.2.0 Alpha and earlier allow remote authenticated users to execute arbitrary SQL commands via the (1) memberslist parameter (aka Member List) in list.php or (2) rowid parameter to adherents/fiche.php. 20120210 Dolibarr CMS v3.2.0 Alpha - SQL Injection Vulnerabilities 51956 Multiple directory traversal vulnerabilities in Dolibarr CMS 3.2.0 Alpha allow remote attackers to read arbitrary files and possibly execute arbitrary code via a .. (dot dot) in the (1) file parameter to document.php or (2) backtopage parameter in a create action to comm/action/fiche.php. 20120227 Re: Dolibarr CMS v3.2.0 Alpha - File Include Vulnerabilities 18480 20120210 Dolibarr CMS v3.2.0 Alpha - File Include Vulnerabilities http://www.vulnerability-lab.com/get_content.php?id=428 dolibarr-multiple-file-include(73136) https://github.com/Dolibarr/dolibarr/commit/5381986e50dd6055f2b3b63281eaacffa0449da2 https://github.com/Dolibarr/dolibarr/commit/8f9b9987ffb42cfbe907fe31ded3001bfc1b3417 Multiple cross-site request forgery (CSRF) vulnerabilities in admin.php in pluck 4.7 allow remote attackers to hijack the authentication of admins for requests that (1) modify the admin email address or (2) modify the blog title via a settings action; (3) add a page via an editpage action, or (4) add a categorie via the blog module. 18474 SQL injection vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to execute arbitrary SQL commands via a malformed URL. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0234. http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf Cross-site request forgery (CSRF) vulnerability in Advantech/BroadWin WebAccess 7.0 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0235. http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf Multiple cross-site request forgery (CSRF) vulnerabilities in Janetter before 3.3.0.0 (aka 3.3.0) allow remote attackers to hijack the authentication of arbitrary users for requests that (1) tweet, (2) upload an image file, or (3) execute arbitrary commands. http://blog.janetter.net/ http://janetter.net/history.html JVN#83459967 JVNDB-2012-000027 Cross-site request forgery (CSRF) vulnerability in SENCHA SNS before 1.0.2 allows remote attackers to hijack the authentication of arbitrary users. JVN#44913777 JVNDB-2012-000029 http://oss.icz.co.jp/news/?p=501 52900 Session fixation vulnerability in SENCHA SNS before 1.0.2 allows remote attackers to hijack web sessions via unspecified vectors. Per: http://cwe.mitre.org/data/definitions/384.html 'CWE-384: Session Fixation' JVN#97200417 JVNDB-2012-000030 http://oss.icz.co.jp/news/?p=501 52900 The TopAccess web-based management interface on TOSHIBA TEC e-Studio multi-function peripheral (MFP) devices with firmware 30x through 302, 35x through 354, and 4xx through 421 allows remote attackers to bypass authentication and obtain administrative privileges via unspecified vectors. JVN#92830293 JVNDB-2012-000028 http://www.toshibatec.co.jp/information/2012/20120405/ Cross-site scripting (XSS) vulnerability in the RECRUIT Dokodemo Rikunabi 2013 extension before 1.0.1 for Google Chrome allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. JVN#90055996 JVNDB-2012-000032 48813 53008 https://chrome.google.com/webstore/detail/cfmkbngdlheahmooldblflapbpngmmbg dokodemorikunabi2012-unspecified-xss(74893) GRScript18.dll before 1.2.2.0 in ActiveScriptRuby (ASR) before 1.8.7 does not properly restrict interaction with an Internet Explorer ActiveX environment, which allows remote attackers to execute arbitrary Ruby code via a crafted HTML document. [ruby-list] 20100619 ANN: ActiveScriptRuby 1.8.7 JVN#33283707 JVNDB-2012-000031 48811 53011 activescriptruby-grscript18-code-exec(74866) Untrusted search path vulnerability in JustSystems Ichitaro 2011 Sou, Ichitaro 2006 through 2011, Ichitaro Government 2006 through 2010, Ichitaro Portable with oreplug, Ichitaro Viewer, JUST School, JUST School 2009 and 2010, JUST Jump 4, JUST Frontier, and oreplug allows local users to gain privileges via a Trojan horse DLL in the current working directory. Per: http://cwe.mitre.org/data/definitions/426.html 'CWE-426: Untrusted Search Path' JVN#95378720 JVNDB-2012-000034 81472 http://www.justsystems.com/jp/info/js12001.html The TwitRocker2 application before 1.0.23 for Android does not properly implement the WebView class, which allows remote attackers to obtain sensitive information via a crafted application. JVN#00000601 JVNDB-2012-000033 81447 48894 53173 twitrocker2-webview-sec-bypass(75036) https://play.google.com/store/apps/details?id=com.studiohitori.twitrocker2 The NTT DOCOMO sp mode mail application 5400 and earlier for Android does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. JVN#82029095 JVNDB-2012-000037 81629 48955 53254 spmode-android-ssl-spoofing(75159) Cross-site scripting (XSS) vulnerability in the cleanup_urls function in forum/utils/html.py in OSQA before 1234, and 0.9.0 Beta 3 and earlier, allows remote attackers to inject arbitrary web script or HTML via vectors related to a crafted URI. JVN#15503729 JVNDB-2012-000036 http://svn.osqa.net/changelog/OSQA/osqa/trunk?cs=1234 53259 osqa-unspecified-xss(75182) Cross-site scripting (XSS) vulnerability in KENT-WEB WEB MART 1.7 and earlier might allow remote attackers to inject arbitrary web script or HTML via a crafted cookie. JVN#47536971 JVNDB-2012-000041 http://www.kent-web.com/cart/mart.html 53539 webmart-craftedcookies-xss(75673) Cross-site scripting (XSS) vulnerability in KENT-WEB WEB MART 1.7 and earlier, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML by leveraging support for Cascading Style Sheets (CSS) expressions. JVN#63941302 JVNDB-2012-000042 http://www.kent-web.com/cart/mart.html 53541 webmart-internetexplorer-cssexpr-xss(75674) app/config/core.php in baserCMS 1.6.15 and earlier does not properly handle installations in shared-hosting environments, which allows remote attackers to hijack sessions by leveraging administrative access to a different domain. http://basercms.net/security/1 JVN#53465692 JVNDB-2012-000043 53543 basercms-core-sec-bypass(75660) The iLunascape application 1.0.4.0 and earlier for Android does not properly implement the WebView class, which allows remote attackers to obtain sensitive stored information via a crafted application. JVN#86044443 JVNDB-2012-000044 53619 https://play.google.com/store/apps/details?id=jp.co.lunascape.android.ilunascape Logitec LAN-W300N/R routers with firmware before 2.27 do not properly restrict login access, which allows remote attackers to obtain administrative privileges and modify settings via vectors related to PPPoE authentication. JVN#85934986 JVNDB-2012-000051 http://www.logitec.co.jp/info/2012/0516.html 53685 Opera before 9.63 does not properly verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. JVN#39707339 JVNDB-2012-000049 http://www.opera.com/docs/changelogs/mac/963/ http://www.opera.com/docs/changelogs/unix/963/ http://www.opera.com/docs/changelogs/windows/963/ Cross-site scripting (XSS) vulnerability in RSSOwl before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via a feed, a different vulnerability than CVE-2006-4760. JVN#77947437 JVNDB-2012-000048 Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment. JVN#21422837 JVNDB-2012-000050 http://sourceforge.net/projects/roundcubemail/files/roundcubemail/0.7/ Cross-site scripting (XSS) vulnerability in Segue 2.2.10.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. JVN#29083866 JVNDB-2012-000052 SQL injection vulnerability in Segue 2.2.10.2 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors. JVN#97995841 JVNDB-2012-000053 The single sign-on (SSO) implementation in EasyVista before 2010.1.1.89 allows remote attackers to bypass authentication via a modified url_account parameter, in conjunction with a valid login name in the SSPI_HEADER parameter, to index.php. VU#273502 Cross-site scripting (XSS) vulnerability in cgi-bin/mt/mt-wizard.cgi in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13, when the product is incompletely installed, allows remote attackers to inject arbitrary web script or HTML via the dbuser parameter, a different vulnerability than CVE-2012-0318. JVN#49836527 JVNDB-2012-000016 http://packetstormsecurity.org/files/110203/Movable-Type-Publishing-Platform-Cross-Site-Scripting.html 20120224 TWSL2012-003: Cross-Site Scripting Vulnerability in Movable Type Publishing Platform DSA-2423 http://www.movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.html http://www.movabletype.org/documentation/appendices/release-notes/513.html 52138 1026738 movable-type-mtwizard-xss(73411) movable-type-publishing-mtwizard-xss(73480) https://www.trustwave.com/spiderlabs/advisories/TWSL2012-003.txt Unspecified vulnerability in Gretech GOM Media Player before 2.1.37.5091 allows remote attackers to execute arbitrary code via a crafted AVI file. http://gom.gomtv.com/gomIntro.html?type=4 gommediaplayer-avi-code-exec(74121) The UTC Fire & Security GE-MC100-NTP/GPS-ZB Master Clock device uses hardcoded credentials for an administrative account, which makes it easier for remote attackers to obtain access via an HTTP session. VU#707254 Multiple directory traversal vulnerabilities in SAP NetWeaver 7.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the logfilename parameter to (1) b2b/admin/log.jsp or (2) b2b/admin/log_view.jsp in the Internet Sales (crm.b2b) component, or (3) ipc/admin/log.jsp or (4) ipc/admin/log_view.jsp in the Application Administration (com.sap.ipc.webapp.ipc) component. http://dsecrg.com/pages/vul/show.php?id=412 http://dsecrg.com/pages/vul/show.php?id=413 http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a 52101 netweaver-logview-directory-traversal(73346) https://service.sap.com/sap/support/notes/1585527 Cross-site scripting (XSS) vulnerability in b2b/auction/container.jsp in the Internet Sales (crm.b2b) module in SAP NetWeaver 7.0 allows remote attackers to inject arbitrary web script or HTML via the _loadPage parameter. http://dsecrg.com/pages/vul/show.php?id=414 http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a 52101 https://service.sap.com/sap/support/notes/1583300 Unspecified vulnerability in the com.sap.aii.mdt.amt.web.AMTPageProcessor servlet in SAP NetWeaver 7.0 allows remote attackers to obtain sensitive information about the Adapter Monitor via unspecified vectors, possibly related to the EnableInvokerServletGlobally property in the servlet_jsp service. http://dsecrg.com/pages/vul/show.php?id=415 http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a 52101 https://service.sap.com/sap/support/notes/1585527 Unspecified vulnerability in the MessagingSystem servlet in SAP NetWeaver 7.0 allows remote attackers to obtain sensitive information about the MessagingSystem Performance Data via unspecified vectors. http://dsecrg.com/pages/vul/show.php?id=416 http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a 52101 https://service.sap.com/sap/support/notes/1585527 Multiple cross-site scripting (XSS) vulnerabilities in fup in Frams' Fast File EXchange (F*EX, aka fex) before 20111129-2 allow remote attackers to inject arbitrary web script or HTML via the (1) to or (2) from parameters. 20120220 Vulnerabilitites in Debian F*EX <= 20100208 and F*EX 20111129-2. 20120220 Re: Vulnerabilitites in Debian F*EX <= 20100208 and F*EX 20111129-2. http://fex.rus.uni-stuttgart.de/fex.html DSA-2414 [oss-security] 20120220 Vulnerabilitites in Debian F*EX <= 20100208 and F*EX 20111129-2. [oss-security] 20120220 Re: Vulnerabilitites in Debian F*EX <= 20100208 and F*EX 20111129-2. [oss-security] 20120223 Re: Vulnerabilitites in Debian F*EX <= 20100208 and F*EX 20111129-2. 52085 SQL injection vulnerability in CONTIMEX Impulsio CMS allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php. http://packetstormsecurity.org/files/109849/Impulsio-CMS-SQL-Injection.html 52063 impulsiocms-index-sql-injection(73303) Multiple cross-site scripting (XSS) vulnerabilities in apps/admin/handlers/preview.php in Elefant CMS 1.0.x before 1.0.2-Beta and 1.1.x before 1.1.5-Beta allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) body parameter to admin/preview. http://www.elefantcms.com/forum/discussion/39/elefant-1.0.2-and-1.1.5-security-updates-released http://www.elefantcms.com/wiki/Changelog 52143 elefantcms-preview-xss(73421) https://www.htbridge.com/advisory/HTB23076 Multiple cross-site request forgery (CSRF) vulnerabilities in main.php in Contao (formerly TYPOlight) 2.11.0 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) delete users via a delete action in the user module, (2) delete news via a delete action in the news module, or (3) delete newsletters via a delete action in the newsletters module. http://ivanobinetti.blogspot.com/2012/02/contaocms-fka-typolight-211-csrf-delete.html http://packetstormsecurity.org/files/110214/ContaoCMS-2.11.0-Cross-Site-Request-Forgery.html 18527 contao-newsletter-csrf(73479) The FeedProxy.aspx script in Umbraco 4.7.0 allows remote attackers to proxy requests on their behalf via the "url" parameter. 20120405 [MATTA-2012-001] CVE-2012-1301; 0day; Open Proxy vulnerability in Umbraco 4.7 52912 https://www.trustmatta.com/advisories/MATTA-2012-001.txt Multiple cross-site scripting (XSS) vulnerabilities in amMap 2.6.3 allow remote attackers to inject arbitrary web script or HTML via the (1) data_file or (2) settings_file parameter to ammap.swf, or (3) the data_file parameter to amtimeline.swf. http://web.appsec.ws/FlashExploitDatabase.php 1038375 https://success.trendmicro.com/solution/1117094 Multiple cross-site scripting (XSS) vulnerabilities in amCharts Flash 1 allow remote attackers to inject arbitrary web script or HTML via the (1) data_file or (2) settings_file parameter to ampie.swf; the message element in the chart_data parameter to (3) amcolumn.swf, (4) amline.swf, (5) amradar.swf, or (6) amxy.sw; or (7) the settings_file parameter to amstock.swf. http://web.appsec.ws/FlashExploitDatabase.php Cross-site request forgery (CSRF) vulnerability in redpass.cgi in D-Link DSL-2640B Firmware EU_4.00 allows remote attackers to hijack the authentication of administrators for requests that change the administrator password via the sysPassword parameter. 18499 52096 dsl2640b-interface-csrf(73316) Memory leak in the Zone-Based Firewall in Cisco IOS 12.4, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted IP packets, aka Bug ID CSCto89536. 48608 20120328 Cisco IOS Software Zone-Based Firewall Vulnerabilities 52753 1026861 The RSVP feature in Cisco IOS 15.0 and 15.1 and IOS XE 3.2.xS through 3.4.xS before 3.4.2S, when a VRF interface is configured, allows remote attackers to cause a denial of service (interface queue wedge and service outage) via crafted RSVP packets, aka Bug ID CSCts80643. 20120328 Cisco IOS Software RSVP Denial of Service Vulnerability 52754 1026865 The MACE feature in Cisco IOS 15.1 and 15.2 allows remote attackers to cause a denial of service (device reload) via crafted transit traffic, aka Bug IDs CSCtq64987 and CSCtu57226. 20120328 Multiple Vulnerabilities in Cisco IOS Software Traffic Optimization Features 52751 1026862 ciscoios-mace-dos(74429) The remote debug shell on the PALO adapter card in Cisco Unified Computing System (UCS) allows local users to gain privileges via malformed show-macstats parameters, aka Bug ID CSCub13772. 20130926 Cisco Unified Computing System Arbitrary Command Execution Vulnerability 1029103 The WAAS Express feature in Cisco IOS 15.1 and 15.2 allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted transit traffic, aka Bug ID CSCtt45381. 20120328 Multiple Vulnerabilities in Cisco IOS Software Traffic Optimization Features 52751 1026862 ciscoios-waas-dos(74428) Memory leak in the SIP inspection feature in the Zone-Based Firewall in Cisco IOS 12.4, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (memory consumption or device reload) via crafted transit SIP traffic, aka Bug ID CSCti46171. 48608 20120328 Cisco IOS Software Zone-Based Firewall Vulnerabilities 52753 1026861 ciscoios-sip-inspection-dos(74437) The multicast implementation in Cisco IOS before 15.1(1)SY allows remote attackers to cause a denial of service (Route Processor crash) by sending packets at a high rate, aka Bug ID CSCts37717. http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.pdf Race condition in the Zone-Based Firewall in Cisco IOS 15.1 and 15.2, when IPS policies are configured, allows remote attackers to cause a denial of service (device crash) by sending IPv6 packets, aka Bug ID CSCtk53534. http://www.cisco.com/en/US/docs/ios/15_1/release/notes/151-3TCAVS.html ciscoios-zonebased-firewall-dos(75414) dot11t/t_if_dot11_hal_ath.c in Cisco IOS 12.3, 12.4, 15.0, and 15.1 allows remote attackers to cause a denial of service (assertion failure and reboot) via 802.11 wireless traffic, as demonstrated by a video call from Apple iOS 5.0 on an iPhone 4S, aka Bug ID CSCtt94391. http://www.cisco.com/en/US/docs/ios/15_1/release/notes/151-2TCAVS.html ciscoios-wireless-traffic-dos(75413) Cisco Unified IP Phones 9900 series devices with firmware 9.1 and 9.2 do not properly handle downloads of configuration information to an RT phone, which allows local users to gain privileges via unspecified injected data, aka Bug ID CSCts32237. http://www.cisco.com/en/US/docs/voice_ip_comm/cuipph/9971_9951_8961/firmware/9_2_3/release_notes/9900_8900_923.html cisco-unified-rt-priv-esc(75412) Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 L through SP11 EP26, T27 LB through SP21 EP10, T27 LC before SP25 EP10, and T27 LD before SP32 CP1 allows remote attackers to execute arbitrary code via a crafted WRF file, a different vulnerability than CVE-2012-1336 and CVE-2012-1337. 20120404 Buffer Overflow Vulnerabilities in the Cisco WebEx Player 1026888 Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 L through SP11 EP26, T27 LB through SP21 EP10, T27 LC before SP25 EP10, and T27 LD before SP32 CP1 allows remote attackers to execute arbitrary code via a crafted WRF file, a different vulnerability than CVE-2012-1335 and CVE-2012-1337. 20120404 Buffer Overflow Vulnerabilities in the Cisco WebEx Player 1026888 Buffer overflow in the Cisco WebEx Recording Format (WRF) player T27 L through SP11 EP26, T27 LB through SP21 EP10, T27 LC before SP25 EP10, and T27 LD before SP32 CP1 allows remote attackers to execute arbitrary code via a crafted WRF file, a different vulnerability than CVE-2012-1335 and CVE-2012-1336. 20120404 Buffer Overflow Vulnerabilities in the Cisco WebEx Player 1026888 webex-wrffile-bo(74606) Cisco IOS 15.0 and 15.1 on Catalyst 3560 and 3750 series switches allows remote authenticated users to cause a denial of service (device reload) by completing local web authentication quickly, aka Bug ID CSCts88664. http://www.cisco.com/en/US/docs/switches/lan/catalyst3750x_3560x/software/release/15.0_1_se/release/notes/OL25302.html 1027349 The Fabric Interconnect component in Cisco Unified Computing System (UCS) 2.0 allows remote attackers to cause a denial of service (process crash) via an attempted SSH session, aka Bug ID CSCtt94543. http://www.cisco.com/en/US/docs/unified_computing/ucs/release/notes/OL_25363.html 1027350 The Fibre Channel over IP (FCIP) implementation in Cisco MDS NX-OS 4.2 and 5.2 on MDS 9000 series switches allows remote attackers to cause a denial of service (module reload) via a crafted FCIP header, aka Bug ID CSCtn93151. http://www.cisco.com/en/US/docs/switches/datacenter/mds9000/sw/5_2/release/notes/nx-os/mds_nxos_rel_notes_522.html 1027348 Cisco Carrier Routing System (CRS) 3.9, 4.0, and 4.1 allows remote attackers to bypass ACL entries via fragmented packets, aka Bug ID CSCtj10975. http://www.cisco.com/cisco/software/release.html?mdfid=279506669&catid=268437899&flowid=1915&reltype=all&relind=AVAILABLE&release=3.9.2&softwareid=280867577 Cisco IOS 15.1 and 15.2, when a clientless SSL VPN is configured, allows remote authenticated users to cause a denial of service (device reload) by using a web browser to refresh the SSL VPN portal page, as demonstrated by the Android browser, aka Bug ID CSCtr86328. http://www.cisco.com/en/US/docs/ios/15_1/release/notes/151-2TCAVS.html 1027371 Cisco Emergency Responder 8.6 and 9.2 allows remote attackers to cause a denial of service (CPU consumption) by sending malformed UDP packets to the CERPT port, aka Bug ID CSCtx38369. https://www.cisco.com/en/US/docs/voice_ip_comm/cer/8_7/english/release/notes/CER0_BK_CEE780BD_00_cisco-emergency-responder-87-release_chapter_00.html Cisco Wide Area Application Services (WAAS) appliances with software 4.4, 5.0, and 5.1 include a one-way hash of a password within output text, which might allow remote attackers to obtain sensitive information via a brute-force attack on the hash string, aka Bug ID CSCty17279. http://www.cisco.com/en/US/docs/app_ntwk_services/waas/waas/v501/release/notes/ws501xrn.pdf Cisco IOS 12.3 and 12.4 on Aironet access points allows remote attackers to cause a denial of service (radio-interface input-queue hang) via IAPP 0x3281 packets, aka Bug ID CSCtc12426. http://www.cisco.com/en/US/docs/wireless/access_point/ios/release/notes/12_3_8_JED1rn.html The igmp_snoop_orib_fill_source_update function in the IGMP process in NX-OS 5.0 and 5.1 on Cisco Nexus 5000 series switches allows remote attackers to cause a denial of service (device reload) via IGMP packets, aka Bug ID CSCts46521. http://www.cisco.com/en/US/docs/switches/datacenter/nexus5000/sw/release/notes/Rel_5_1_3_N1_1/Nexus5000_Release_Notes_5_1_3_N1.pdf Cisco IOS 15.1 and 15.2, when the Multicast Music-on-Hold (MMoH) feature of Cisco Unified Communications Manager (CUCM) is enabled, allows remote attackers to obtain sensitive crosstalk information by listening during a PSTN call, aka Bug ID CSCtx77750. http://www.cisco.com/en/US/docs/ios/15_1/release/notes/151-3TCAVS.html Cisco Unified Computing System (UCS) 1.4 and 2.0 allows remote authenticated users to cause a denial of service (device reload) via a malformed SNMP request to a Fabric Interconnect (FI) device, aka Bug ID CSCts32452. http://www.cisco.com/en/US/docs/unified_computing/ucs/release/notes/OL_24086.html Cisco Unified Computing System (UCS) 1.4 and 2.0 allows remote authenticated users to cause a denial of service (device reload) via a malformed SNMP request to a Fabric Interconnect (FI) device, aka Bug ID CSCts32463. http://www.cisco.com/en/US/docs/unified_computing/ucs/release/notes/OL_24086.html Cisco IOS before 15.1(1)SY on ASR 1000 devices, when Multicast Listener Discovery (MLD) tracking is enabled for IPv6, allows remote attackers to cause a denial of service (device reload) via crafted MLD packets, aka Bug ID CSCtz28544. http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.pdf The MallocLite implementation in Cisco IOS 12.0, 12.2, 15.0, 15.1, and 15.2 allows remote attackers to cause a denial of service (Route Processor crash) via a BGP UPDATE message with a modified local-preference (aka LOCAL_PREF) attribute length, aka Bug ID CSCtq06538. http://www.cisco.com/en/US/docs/ios/12_2sr/release/notes/122SRcavs1.html Cisco AnyConnect Secure Mobility Client 3.0 before 3.0.08057 allows remote authenticated users to cause a denial of service (vpnagentd process crash) via a crafted packet, aka Bug ID CSCty01670. http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect30/release/notes/anyconnect30rn.html Unspecified vulnerability in the NetEaseWeibo (com.netease.wb) application 1.2.1 and 1.2.2 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1380-vulnerability-in-NetEaseWeibo.html Unspecified vulnerability in the NetEase CloudAlbum (com.netease.cloudalbum) application 2.0.0 and 2.2.0 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1381-vulnerability-in-NetEaseCloudAlbum.html Unspecified vulnerability in the Youdao Dictionary (com.youdao.dict) application 1.6.1, 2.0.1(2), and 3.0.0(1) for Android has unknown impact and attack vectors. 48356 http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1382-vulnerability-in-YoudaoDictionary.html Unspecified vulnerability in the NetEase Reader (com.netease.pris) application 1.1.2 and 1.2.0 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1383-vulnerability-in-NetEaseReader.html Unspecified vulnerability in the NetEase Pmail (com.netease.rpmms) application 0.5.0 and 0.5.2 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1384-vulnerability-in-NetEasePmail.html Unspecified vulnerability in the NetEase WeiboHD (com.netease.wbhd) application 1.0.0 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1385-vulnerability-in-NetEaseWeiboHD.html Unspecified vulnerability in the YouMail Visual Voicemail Plus (com.youmail.android.vvm) application 2.0.45 and 2.1.43 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1386-vulnerability-in-YouMailVisualVoicemailPlus.html Unspecified vulnerability in the RealTalk (com.tmsmanager.tms) application A.0.9.250 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1387-vulnerability-in-RealTalk.html Unspecified vulnerability in the XiXunTianTian (com.xixun.tiantian) application 0.6.2 beta for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1388-vulnerability-in-XiXunTianTian.html Unspecified vulnerability in the Di Long Weibo (com.icekirin.weibos) application 1.9.9 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1389-vulnerability-in-DiLongWeibo.html Unspecified vulnerability in the Miso (com.bazaarlabs.miso) application 2.2 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1390-vulnerability-in-Miso.html Unspecified vulnerability in the mOffice - Outlook sync (com.innov8tion.isharesync) application 3.1 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1391-vulnerability-in-mOffice.html Unspecified vulnerability in the Dolphin Browser HD (mobi.mgeek.TunnyBrowser) application 6.2.0, 7.2.1, 7.3.0, and 7.4.0 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1392-vulnerability-in-DolphinBrowserHD.html Unspecified vulnerability in the GO SMS Pro (com.jb.gosms) application 3.72, 4.10, and 4.35 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1393-vulnerability-in-GOSMSPro.html Unspecified vulnerability in the GO Email Widget (com.gau.go.launcherex.gowidget.emailwidget) application 1.3.1, 1.8, and 1.81 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1394-vulnerability-in-GOEmailWidget.html Unspecified vulnerability in the GO TwiWidget (com.gau.go.launcherex.gowidget.twitterwidget) application 1.7 and 2.1 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1395-vulnerability-in-GOTwiWidget.html Unspecified vulnerability in the GO FBWidget (com.gau.go.launcherex.gowidget.fbwidget) application 1.9 and 2.1 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1396-vulnerability-in-GOFBWidget.html Unspecified vulnerability in the GO QQWeiboWidget (com.gau.go.launcherex.gowidget.qqweibowidget) application 1.2 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1397-vulnerability-in-GOQQWeiboWidget.html Unspecified vulnerability in the GO WeiboWidget (com.gau.go.launcherex.gowidget.weibowidget) application 2.4 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1398-vulnerability-in-GOWeiboWidget.html Unspecified vulnerability in the U+Box 2.0 (lg.uplusbox) application 2.0.2 and 2.0.8.4 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1399-vulnerability-in-U%2BBox.html Unspecified vulnerability in the U+Box 2.0 Pad (lg.uplusbox.pad) application 2.0.8.4 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1400-vulnerability-in-U%2BBoxPad.html Unspecified vulnerability in the CamScanner (com.intsig.camscanner) application 1.2.2.20110823 and 1.3.2.20120116 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1401-vulnerability-in-CamScanner.html Unspecified vulnerability in the QianXun YingShi (com.qianxun.yingshi) application 1.2.3 and 1.3.4 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1402-vulnerability-in-QianXunYingShi.html Unspecified vulnerability in the Dolphin Browser CN (com.dolphin.browser.cn) application 6.3.1 and 7.2.1 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1403-vulnerability-in-DolphinBrowserCN.html Unspecified vulnerability in the Dolphin Browser Mini (com.dolphin.browser) application 2.2 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1404-vulnerability-in-DolphinBrowserMini.html Unspecified vulnerability in the GO Note Widget (com.gau.go.launcherex.gowidget.notewidget) application 1.5 and 1.9 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1405-vulnerability-in-GONoteWidget.html Unspecified vulnerability in the GO Bookmark Widget (com.gau.go.launcherex.gowidget.bookmark) application 1.1 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1406-vulnerability-in-GOBookmarkWidget.html Unspecified vulnerability in the GO Message Widget (com.gau.go.launcherex.gowidget.smswidget) application 1.9, 2.1, and 2.3 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1407-vulnerability-in-GOMessageWidget.html Unspecified vulnerability in the App Lock (com.cc.applock) application 1.7.5 and 1.7.6 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1408-vulnerability-in-AppLock.html Unspecified vulnerability in the Tiny Password (com.tinycouch.android.freepassword) application 1.64 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1409-vulnerability-in-TinyPassword.html Multiple cross-site scripting (XSS) vulnerabilities in the History Window implementation in Kadu 0.9.0 through 0.11.0 allow remote attackers to inject arbitrary web script or HTML via a crafted (1) SMS message, (2) presence message, or (3) status description. [oss-security] 20120227 Re: Re: CVE Status Clarification / Request -- kadu: Stored XSS by parsing contact's status and sms messages in history [oss-security] 20120227 CVE Status Clarification / Request -- kadu: Stored XSS by parsing contact's status and sms messages in history https://bugzilla.novell.com/show_bug.cgi?id=749036 https://bugzilla.redhat.com/show_bug.cgi?id=797777 https://gitorious.org/kadu/kadu/commit/91772e46541e22cbc2c7bf41a1a9798c2a58f6d6 https://gitorious.org/kadu/kadu/commit/94e7479617d78a1649a0763960edade7ad09a0d0 https://gitorious.org/kadu/kadu/commit/e9506be6d3dcdd408fdf83d8eb82416c9b798c84 https://gitorious.org/kadu/kadu/commit/ebe3674cf0f3aa9b36308c06e19cb293cc790b52 Cross-site scripting (XSS) vulnerability in zc_install/includes/modules/pages/database_setup/header_php.php in Zen Cart 1.5.0 and earlier, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the db_username parameter to zc_install/index.php. https://www.trustwave.com/spiderlabs/advisories/TWSL2012-004.txt Cross-site request forgery (CSRF) vulnerability in manager/news.php in Plume CMS 1.2.4 and earlier allows remote attackers to hijack the authentication of administrators for requests that create News pages via a publish action. 18502 plumecms-news-csrf(73317) Cross-site request forgery (CSRF) vulnerability in lib/logout.php in DFLabs PTK 1.0.5 and earlier allows remote attackers to hijack the authentication of administrators or investigators for requests that trigger a logout. 18513 Multiple cross-site request forgery (CSRF) vulnerabilities in SocialCMS 1.0.2 allow remote attackers to hijack the authentication of administrators for requests that (1) add administrator accounts via a member_new action to my_admin/admin1_members.php or (2) modify the default site title via a save action to my_admin/admin1_configuration.php. 17193 18487 socialcms-multiple-csrf(66985) Multiple cross-site scripting (XSS) vulnerabilities in Local Phone book and Blacklist form in Yealink VOIP Phones allow remote authenticated users to inject arbitrary web script or HTML via the user field to cgi-bin/ConfigManApp.com. 20120313 Yealink VOIP Phone Persistent Cross Site Scripting Vulnerability [CVE-2012-1417] http://packetstormsecurity.org/files/110320/yealink-xss.txt 18540 52209 yealinkvoipphone-multiple-xss(73573) Multiple unspecified vulnerabilities in Google Chrome before 17.0.963.60 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors. http://googlechromereleases.blogspot.com/2012/02/stable-channel-update-for-chromebooks_24.html The TAR file parser in ClamAV 0.96.4 and Quick Heal (aka Cat QuickHeal) 11.00 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial [aliases] character sequence. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products 52572 The TAR file parser in Quick Heal (aka Cat QuickHeal) 11.00, Command Antivirus 5.2.11.5, F-Prot Antivirus 4.6.2.117, Fortinet Antivirus 4.2.254.0, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, Panda Antivirus 10.0.2.7, and Rising Antivirus 22.83.00.03 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial \7fELF character sequence. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products The TAR file parser in Quick Heal (aka Cat QuickHeal) 11.00, Norman Antivirus 6.06.12, Rising Antivirus 22.83.00.03, and AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial MSCF character sequence. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products The TAR file parser in Quick Heal (aka Cat QuickHeal) 11.00, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, and Rising Antivirus 22.83.00.03 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial ITSF character sequence. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products 52583 The TAR file parser in Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, F-Prot Antivirus 4.6.2.117, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, K7 AntiVirus 9.77.3565, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, PC Tools AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, and VirusBuster 13.6.151.0 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial MZ character sequence. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products The TAR file parser in Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Jiangmin Antivirus 13.0.900, Norman Antivirus 6.06.12, PC Tools AntiVirus 7.0.3.5, and Sophos Anti-Virus 4.61.0 allows remote attackers to bypass malware detection via a POSIX TAR file with a \19\04\00\10 character sequence at a certain location. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Emsisoft Anti-Malware 5.1.0.1, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, PC Tools AntiVirus 7.0.3.5, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Trend Micro AntiVirus 9.120.0.1004, and Trend Micro HouseCall 9.120.0.1004 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial \50\4B\03\04 character sequence. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products The TAR file parser in Quick Heal (aka Cat QuickHeal) 11.00, Command Antivirus 5.2.11.5, F-Prot Antivirus 4.6.2.117, K7 AntiVirus 9.77.3565, Norman Antivirus 6.06.12, and Rising Antivirus 22.83.00.03 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial \42\5A\68 character sequence. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products 52585 multiple-av-tar-evasion-cve20121426(74241) The TAR file parser in Quick Heal (aka Cat QuickHeal) 11.00, Norman Antivirus 6.06.12, and Sophos Anti-Virus 4.61.0 allows remote attackers to bypass malware detection via a POSIX TAR file with a \57\69\6E\5A\69\70 character sequence at a certain location. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products 52587 multiple-av-tar-evasion-cve20121427(74242) The TAR file parser in Quick Heal (aka Cat QuickHeal) 11.00, Norman Antivirus 6.06.12, and Sophos Anti-Virus 4.61.0 allows remote attackers to bypass malware detection via a POSIX TAR file with a \4a\46\49\46 character sequence at a certain location. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products 52579 multiple-av-tar-evasion-cve20121428(74243) The ELF file parser in Bitdefender 7.2, Comodo Antivirus 7424, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, F-Secure Anti-Virus 9.0.16160.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, and nProtect Anti-Virus 2011-01-17.01 allows remote attackers to bypass malware detection via an ELF file with a ustar character sequence at a certain location. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products multiple-av-elf-ustar-evasion(74244) The ELF file parser in Bitdefender 7.2, Comodo Antivirus 7424, eSafe 7.0.17.0, F-Secure Anti-Virus 9.0.16160.0, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, nProtect Anti-Virus 2011-01-17.01, Sophos Anti-Virus 4.61.0, and Rising Antivirus 22.83.00.03 allows remote attackers to bypass malware detection via an ELF file with a \19\04\00\10 character sequence at a certain location. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products The ELF file parser in Bitdefender 7.2, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0.16160.0, McAfee Gateway (formerly Webwasher) 2010.1C, nProtect Anti-Virus 2011-01-17.01, Sophos Anti-Virus 4.61.0, and Rising Antivirus 22.83.00.03 allows remote attackers to bypass malware detection via an ELF file with a \4a\46\49\46 character sequence at a certain location. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products The Microsoft EXE file parser in Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an EXE file with a \57\69\6E\5A\69\70 character sequence at a certain location. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different EXE parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products The Microsoft EXE file parser in AhnLab V3 Internet Security 2011.01.18.00, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an EXE file with a \4a\46\49\46 character sequence at a certain location. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different EXE parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products The Microsoft EXE file parser in AhnLab V3 Internet Security 2011.01.18.00, Emsisoft Anti-Malware 5.1.0.1, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an EXE file with a \19\04\00\10 character sequence at a certain location. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different EXE parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products The Microsoft EXE file parser in AhnLab V3 Internet Security 2011.01.18.00, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an EXE file with a \50\4B\4C\49\54\45 character sequence at a certain location. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different EXE parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products The Microsoft EXE file parser in AhnLab V3 Internet Security 2011.01.18.00, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an EXE file with a \2D\6C\68 character sequence at a certain location. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different EXE parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products The Microsoft Office file parser in Comodo Antivirus 7425 allows remote attackers to bypass malware detection via an Office file with a \50\4B\53\70\58 character sequence at a certain location. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products 52597 The Microsoft Office file parser in Comodo Antivirus 7425 and Sophos Anti-Virus 4.61.0 allows remote attackers to bypass malware detection via an Office file with a ustar character sequence at a certain location. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different Office parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products The ELF file parser in eSafe 7.0.17.0, Rising Antivirus 22.83.00.03, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an ELF file with a modified padding field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products 52602 The ELF file parser in Norman Antivirus 6.06.12, eSafe 7.0.17.0, CA eTrust Vet Antivirus 36.1.8511, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an ELF file with a modified identsize field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products The Microsoft EXE file parser in eSafe 7.0.17.0 and Prevx 3.0 allows remote attackers to bypass malware detection via an EXE file with a modified value in any of several e_ fields. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different EXE parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products The ELF file parser in Quick Heal (aka Cat QuickHeal) 11.00, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, eSafe 7.0.17.0, Kaspersky Anti-Virus 7.0.0.125, F-Secure Anti-Virus 9.0.16160.0, Sophos Anti-Virus 4.61.0, Antiy Labs AVL SDK 2.0.3.7, Rising Antivirus 22.83.00.03, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an ELF file with a modified class field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products 52598 The RAR file parser in ClamAV 0.96.4, Rising Antivirus 22.83.00.03, Quick Heal (aka Cat QuickHeal) 11.00, G Data AntiVirus 21, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Command Antivirus 5.2.11.5, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Emsisoft Anti-Malware 5.1.0.1, PC Tools AntiVirus 7.0.3.5, F-Prot Antivirus 4.6.2.117, VirusBuster 13.6.151.0, Fortinet Antivirus 4.2.254.0, Antiy Labs AVL SDK 2.0.3.7, K7 AntiVirus 9.77.3565, Trend Micro HouseCall 9.120.0.1004, Kaspersky Anti-Virus 7.0.0.125, Jiangmin Antivirus 13.0.900, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, Sophos Anti-Virus 4.61.0, NOD32 Antivirus 5795, Avira AntiVir 7.11.1.163, Norman Antivirus 6.06.12, McAfee Anti-Virus Scanning Engine 5.400.0.1158, Panda Antivirus 10.0.2.7, McAfee Gateway (formerly Webwasher) 2010.1C, Trend Micro AntiVirus 9.120.0.1004, Comodo Antivirus 7424, Bitdefender 7.2, eSafe 7.0.17.0, F-Secure Anti-Virus 9.0.16160.0, nProtect Anti-Virus 2011-01-17.01, AhnLab V3 Internet Security 2011.01.18.00, AVG Anti-Virus 10.0.0.1190, avast! Antivirus 4.8.1351.0 and 5.0.677.0, and VBA32 3.12.14.2 allows user-assisted remote attackers to bypass malware detection via a RAR file with an initial MZ character sequence. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different RAR parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products 52612 The ELF file parser in eSafe 7.0.17.0, Prevx 3.0, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an ELF file with a modified abiversion field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products 52604 The ELF file parser in eSafe 7.0.17.0, Rising Antivirus 22.83.00.03, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an ELF file with a modified abi field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products 52605 The ELF file parser in Quick Heal (aka Cat QuickHeal) 11.00, McAfee Anti-Virus Scanning Engine 5.400.0.1158, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Norman Antivirus 6.06.12, eSafe 7.0.17.0, Kaspersky Anti-Virus 7.0.0.125, McAfee Gateway (formerly Webwasher) 2010.1C, Sophos Anti-Virus 4.61.0, CA eTrust Vet Antivirus 36.1.8511, Antiy Labs AVL SDK 2.0.3.7, PC Tools AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an ELF file with a modified encoding field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products 52600 The ELF file parser in Fortinet Antivirus 4.2.254.0, eSafe 7.0.17.0, Dr.Web 5.0.2.03300, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an ELF file with a modified e_version field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products 52601 The CAB file parser in Quick Heal (aka Cat QuickHeal) 11.00, Trend Micro AntiVirus 9.120.0.1004, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Trend Micro HouseCall 9.120.0.1004, and Emsisoft Anti-Malware 5.1.0.1 allows remote attackers to bypass malware detection via a CAB file with a modified cbCabinet field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different CAB parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products 52603 The CAB file parser in NOD32 Antivirus 5795 and Rising Antivirus 22.83.00.03 allows remote attackers to bypass malware detection via a CAB file with a modified vMajor field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different CAB parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products 52616 The CAB file parser in Emsisoft Anti-Malware 5.1.0.1, Sophos Anti-Virus 4.61.0, and Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0 allows remote attackers to bypass malware detection via a CAB file with a modified reserved3 field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different CAB parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products 52617 The CAB file parser in Emsisoft Anti-Malware 5.1.0.1 and Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0 allows remote attackers to bypass malware detection via a CAB file with a modified reserved2 field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different CAB parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products The CAB file parser in Emsisoft Anti-Malware 5.1.0.1, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, and Quick Heal (aka Cat QuickHeal) 11.00 allows remote attackers to bypass malware detection via a CAB file with a modified reserved1 field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different CAB parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products 52619 The CAB file parser in Dr.Web 5.0.2.03300, Trend Micro HouseCall 9.120.0.1004, Kaspersky Anti-Virus 7.0.0.125, Sophos Anti-Virus 4.61.0, Trend Micro AntiVirus 9.120.0.1004, McAfee Gateway (formerly Webwasher) 2010.1C, Emsisoft Anti-Malware 5.1.0.1, CA eTrust Vet Antivirus 36.1.8511, Antiy Labs AVL SDK 2.0.3.7, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, Rising Antivirus 22.83.00.03, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via a CAB file with a modified coffFiles field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different CAB parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products 52621 The ELF file parser in Dr.Web 5.0.2.03300, eSafe 7.0.17.0, McAfee Gateway (formerly Webwasher) 2010.1C, Rising Antivirus 22.83.00.03, Fortinet Antivirus 4.2.254.0, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an ELF file with a modified ei_version field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products The CAB file parser in NOD32 Antivirus 5795 and Rising Antivirus 22.83.00.03 allows remote attackers to bypass malware detection via a CAB file with a modified vMinor version field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different CAB parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products 52607 The TAR file parser in AVG Anti-Virus 10.0.0.1190, Quick Heal (aka Cat QuickHeal) 11.00, Comodo Antivirus 7424, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, Panda Antivirus 10.0.2.7, Rising Antivirus 22.83.00.03, Sophos Anti-Virus 4.61.0, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Trend Micro AntiVirus 9.120.0.1004, and Trend Micro HouseCall 9.120.0.1004 allows remote attackers to bypass malware detection via a TAR file with an appended ZIP file. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products 52608 multiple-av-zip-archive-evasion(74289) The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, G Data AntiVirus 21, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, PC Tools AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Trend Micro AntiVirus 9.120.0.1004, Trend Micro HouseCall 9.120.0.1004, VBA32 3.12.14.2, and VirusBuster 13.6.151.0 allows remote attackers to bypass malware detection via a TAR archive entry with a length field that exceeds the total TAR file size. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations. openSUSE-SU-2012:0833 http://www.ieee-security.org/TC/SP2012/program.html MDVSA-2012:094 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products 52610 multiple-av-tar-length-evasion(74293) The Microsoft CHM file parser in ClamAV 0.96.4 and Sophos Anti-Virus 4.61.0 allows remote attackers to bypass malware detection via a crafted reset interval in the LZXC header of a CHM file. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different CHM parser implementations. openSUSE-SU-2012:0833 http://www.ieee-security.org/TC/SP2012/program.html MDVSA-2012:094 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products 52611 multiple-av-chm-header-evasion(74301) The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, Emsisoft Anti-Malware 5.1.0.1, F-Prot Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0.16160.0, Fortinet Antivirus 4.2.254.0, G Data AntiVirus 21, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, nProtect Anti-Virus 2011-01-17.01, Panda Antivirus 10.0.2.7, PC Tools AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, Sophos Anti-Virus 4.61.0, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Trend Micro AntiVirus 9.120.0.1004, Trend Micro HouseCall 9.120.0.1004, VBA32 3.12.14.2, and VirusBuster 13.6.151.0 allows remote attackers to bypass malware detection via a TAR archive entry with a length field corresponding to that entire entry, plus part of the header of the next entry. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations. openSUSE-SU-2012:0833 http://www.ieee-security.org/TC/SP2012/program.html MDVSA-2012:094 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products 52623 multiple-av-tar-header-evasion(74302) The Gzip file parser in Antiy Labs AVL SDK 2.0.3.7, Quick Heal (aka Cat QuickHeal) 11.00, Command Antivirus 5.2.11.5, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, and VBA32 3.12.14.2 allows remote attackers to bypass malware detection via a .tar.gz file with stray bytes at the end. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different Gzip parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products 52629 multiple-av-tar-gzip-evasion(74308) The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, F-Secure Anti-Virus 9.0.16160.0, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, Rising Antivirus 22.83.00.03, Sophos Anti-Virus 4.61.0, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Trend Micro AntiVirus 9.120.0.1004, Trend Micro HouseCall 9.120.0.1004, and VBA32 3.12.14.2 allows remote attackers to bypass malware detection via a .tar.gz file with multiple compressed streams. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different Gzip parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products 52626 The ZIP file parser in AhnLab V3 Internet Security 2011.01.18.00, AVG Anti-Virus 10.0.0.1190, Quick Heal (aka Cat QuickHeal) 11.00, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, Fortinet Antivirus 4.2.254.0, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, Kaspersky Anti-Virus 7.0.0.125, Norman Antivirus 6.06.12, Sophos Anti-Virus 4.61.0, and AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11 allows remote attackers to bypass malware detection via a ZIP file containing an invalid block of data at the beginning. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ZIP parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products 52613 multiple-av-zip-file-evasion(74310) The ELF file parser in AhnLab V3 Internet Security 2011.01.18.00, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0.16160.0, McAfee Anti-Virus Scanning Engine 5.400.0.1158, Norman Antivirus 6.06.12, nProtect Anti-Virus 2011-01-17.01, and Panda Antivirus 10.0.2.7 allows remote attackers to bypass malware detection via an ELF file with a modified endianness field. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different ELF parser implementations. http://www.ieee-security.org/TC/SP2012/program.html 20120319 Evasion attacks expoliting file-parsing vulnerabilities in antivirus products 52614 multiple-av-elf-file-evasion(74311) Dashboard Server for NetMechanica NetDecision before 4.6.1 allows remote attackers to obtain the installation path via a request with a trailing "?" character, which causes Dashboard to attempt to access a non-existent resource. NOTE: some of these details are obtained from third party information. http://secpod.org/advisories/SecPod_Netmechanica_NetDecision_Dashboard_Server_Info_Disc_Vuln.txt http://secpod.org/blog/?p=478 18543 http://www.netmechanica.com/news/?news_id=26 52645 netdecision-info-disclosure(73549) Stack-based buffer overflow in the HTTP Server in NetMechanica NetDecision before 4.6.1 allows remote attackers to cause a denial of service (application crash) via a long URL in an HTTP request. NOTE: some of these details are obtained from third party information. http://secpod.org/advisories/SecPod_Netmechanica_NetDecision_HTTP_Server_DoS_Vuln.txt http://secpod.org/blog/?p=484 18541 http://www.netmechanica.com/news/?news_id=26 52194 52208 netdecision-http-dos(73528) The Traffic Grapher Server for NetMechanica NetDecision before 4.6.1 allows remote attackers to obtain the source code of NtDecision script files with a .nd extension via an invalid version number in an HTTP request, as demonstrated using default.nd. NOTE: some of these details are obtained from third party information. http://secpod.org/advisories/SecPod_Netmechanica_NetDecision_Traffic_Grapher_Server_SourceCode_Disc_Vuln.txt http://secpod.org/blog/?p=481 18542 http://www.netmechanica.com/news/?news_id=26 52196 netdecision-traffic-nd-source-disclosure(73531) Multiple directory traversal vulnerabilities in the iBrowser plugin library, as used in Open Journal Systems before 2.3.7, allow remote authenticated users to (1) delete or (2) rename arbitrary files via a .. (dot dot) in the param parameter to lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/ibrowser/scripts/rfiles.php. http://pkp.sfu.ca/support/forum/viewtopic.php?f=2&t=8431 https://www.htbridge.com/advisory/HTB23079 Incomplete blacklist vulnerability in Open Journal Systems before 2.3.7 allows remote authenticated users with the Author Role permission to execute arbitrary code by uploading a file with an executable extension that is not ".php", then accessing it via a direct request to the file in submission/original/ in the associated article directory, as demonstrated using .pHp, .asp, and other extensions. Per: http://cwe.mitre.org/data/definitions/184.html 'CWE-184: Incomplete Blacklist' http://pkp.sfu.ca/ojs/RELEASE-2.3.7 http://pkp.sfu.ca/support/forum/viewtopic.php?f=2&t=8431 https://www.htbridge.com/advisory/HTB23079 Multiple cross-site scripting (XSS) vulnerabilities in Open Journal Systems before 2.3.7 allow remote attackers and remote authenticated users to inject arbitrary web script or HTML via the (1) editor or (2) callback parameters to lib/pkp/lib/tinymce/jscripts/tiny_mce/plugins/ibrowser/ibrowser.php in the iBrowser plugin, (3) authors[][url] parameter to index.php, or (4) Bio Statement or (5) Abstract of Submission fields to the stripUnsafeHtml function in lib/pkp/classes/core/String.inc.php. 20120321 Multiple vulnerabilities in Open Journal Systems (OJS) http://pkp.sfu.ca/ojs/RELEASE-2.3.7 http://pkp.sfu.ca/support/forum/viewtopic.php?f=2&t=8431 open-journal-index-xss(74225) open-journal-string-xss(74226) open-journal-editor-xss(74227) open-journal-articleid-xss(74228) https://www.htbridge.com/advisory/HTB23079 Multiple cross-site scripting (XSS) vulnerabilities in code_editor.php in ocPortal before 7.1.6 allow remote attackers to inject arbitrary web script or HTML via the (1) path or (2) line parameters. http://ocportal.com/site/news/view/new-releases/ocportal-7-1-6-released.htm http://ocportal.com/site/news/view/ocportal-security-update.htm https://www.htbridge.com/advisory/HTB23078 Directory traversal vulnerability in catalogue_file.php in ocPortal before 7.1.6 allows remote attackers to read arbitrary files via a .. (dot dot) in the file parameter. http://ocportal.com/site/news/view/new-releases/ocportal-7-1-6-released.htm http://ocportal.com/site/news/view/ocportal-security-update.htm https://www.htbridge.com/advisory/HTB23078 VMware vCenter Chargeback Manager (aka CBM) before 2.0.1 does not properly handle XML API requests, which allows remote attackers to read arbitrary files or cause a denial of service via unspecified vectors. http://www.vmware.com/security/advisories/VMSA-2012-0002.html Unspecified vulnerability in the Youni SMS (com.snda.youni) application 2.1.0c and 2.1.0d for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1474-vulnerability-in-YouniSMS.html Unspecified vulnerability in the YagattaTalk Messenger (com.iskoot.yagatta.yagattatalk) application 1.00.01.08 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1475-vulnerability-in-YagattaTalkMessenger.html Unspecified vulnerability in the KKtalk (com.kkliaotian.android) application 4.0.0 and 4.1.5 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1476-vulnerability-in-KKtalk.html Unspecified vulnerability in the Cnectd (mci.cnectd) application 3.1.0 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1477-vulnerability-in-Cnectd.html Unspecified vulnerability in the UCMobile BloveStorm (com.blovestorm) application 2.2.0 and 3.2.1 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1478-vulnerability-in-UCMobileBloveStorm.html blovestorm-android-unspecified(74024) Unspecified vulnerability in the AContact (com.movester.quickcontact) application 1.8.2 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1479-vulnerability-in-AContact.html acontact-android-unspecified(74025) Unspecified vulnerability in the Pansi SMS (com.pansi.msg) application 1.97, 2.01, and 2.07 for Android has unknown impact and attack vectors. http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1480-vulnerability-in-PansiSMS.html pansisms-android-unspecified(73963) Unspecified vulnerability in the Textdroid (com.app.android.textdroid) application 2.5.2 for Android has unknown impact and attack vectors. 80168 52490 http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1481-vulnerability-in-Textdroid.html textdroid-android-unspecified(74052) Unspecified vulnerability in the TouchPal Contacts (com.cootek.smartdialer) application 3.3.1 and 4.0.1 for Android has unknown impact and attack vectors. 80169 52491 http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1482-vulnerability-in-TouchPalContacts.html touchpal-android-unspecified(74051) Unspecified vulnerability in the Message Forwarder (com.gmail.zbnetium) application 1.12.20110409.1 for Android has unknown impact and attack vectors. 80170 52492 http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1483-vulnerability-in-MessageForwarder.html message-forward-android-unspecified(74050) Unspecified vulnerability in the WaliSMS CN (cn.com.wali.walisms) application 2.9.2 and 3.7.0 for Android has unknown impact and attack vectors. 80171 52495 http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1484-vulnerability-in-WaliSMSCN.html walisms-android-unspecified(74049) Unspecified vulnerability in the NetFront Life Browser (com.access_company.android.nflifebrowser.lite) application 2.2.0 and 2.3.0 for Android has unknown impact and attack vectors. 80172 48557 52480 http://www4.comp.polyu.edu.hk/~appsec/bugs/CVE-2012-1485-vulnerability-in-NetFrontLifeBrowser.html netfront-android-unspecified(74048) F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers' installations and do not properly restrict access to this key, which makes it easier for remote attackers to perform SSH logins via the PubkeyAuthentication option. http://support.f5.com/kb/en-us/solutions/public/13000/600/sol13600.html http://www.theregister.co.uk/2012/06/13/f5_kit_metasploit_exploit/ https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/ssh/f5_bigip_known_privkey.rb https://www.trustmatta.com/advisories/MATTA-2012-002.txt The default configuration of Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 supports the "mt:Include file=" attribute, which allows remote authenticated users to conduct directory traversal attacks and read arbitrary files by leveraging the template-designer role. DSA-2423 http://www.movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.html http://www.movabletype.org/documentation/appendices/release-notes/513.html Multiple cross-site request forgery (CSRF) vulnerabilities in Webfolio CMS 1.1.4 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator via an add action to admin/users/add or (2) modify a web page via a save action to admin/pages/edit/web_page_name. http://ivanobinetti.blogspot.com/2012/02/webfoliocms-114-csrf-add-adminmodify.html http://packetstormsecurity.org/files/110294/WebfolioCMS-1.1.4-Cross-Site-Request-Forgery.html 18536 52218 webfoliocms-addadmin-modifywebpage-csrf(73575) The JPEG 2000 codec (jp2.c) in OpenJPEG before 1.5 allows remote attackers to execute arbitrary code via a crafted palette index in a CMAP record of a JPEG image, which triggers memory corruption, aka "out-of heap-based buffer write." http://code.google.com/p/openjpeg/source/detail?r=1330 FEDORA-2012-9628 FEDORA-2012-9602 http://openjpeg.googlecode.com/svn/branches/openjpeg-1.5/NEWS GLSA-201206-06 http://technet.microsoft.com/en-us/security/msvr/msvr12-004 52654 https://bugzilla.redhat.com/show_bug.cgi?id=805912 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012. Notes: none. Double free vulnerability in the PyPAM_conv in PAMmodule.c in PyPam 0.5.0 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a NULL byte in a password string. openSUSE-SU-2012:0487 USN-1395-1 DSA-2430 http://www.lsexperts.de/advisories/lse-2012-03-01.txt pypam-password-dos(73857) GLSA-201507-09 Cross-site scripting (XSS) vulnerability in Six Apart (formerly Six Apart KK) Movable Type (MT) Pro 5.13 allows remote attackers to inject arbitrary web script or HTML via the comment section. http://packetstormsecurity.org/files/117564/Movable-Type-Pro-5.13en-Cross-Site-Scripting.html http://www.cloudscan.me/2012/10/cve-2012-1503-movable-type-pro-513en.html 22151 56160 movabletype-mt513en-xss(79521) SQL injection vulnerability in the updateStatus function in lib/models/benefits/Hsp.php in OrangeHRM before 2.7 allows remote authenticated users to execute arbitrary SQL commands via the hspSummaryId parameter to plugins/ajaxCalls/haltResumeHsp.php. NOTE: some of these details are obtained from third party information. http://blog.orangehrm.com/2012/04/24/orangehrm-27-stable-release-with-complete-localization/ 53433 orangehrm-haltresumehsp-sql-injection(75472) https://www.htbridge.com/advisory/HTB23080 Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.7 allow remote attackers to inject arbitrary web script or HTML via the (1) newHspStatus parameter to plugins/ajaxCalls/haltResumeHsp.php, (2) sortOrder1 parameter to templates/hrfunct/emppop.php, or (3) uri parameter to index.php. http://blog.orangehrm.com/2012/04/24/orangehrm-27-stable-release-with-complete-localization/ 53433 orangehrm-multiplescripts-xss(75473) https://www.htbridge.com/advisory/HTB23080 The XPDM display driver in VMware ESXi 4.0, 4.1, and 5.0; VMware ESX 4.0 and 4.1; and VMware View before 4.6.1 allows guest OS users to gain guest OS privileges or cause a denial of service (NULL pointer dereference) via unspecified vectors. 20120316 VMSA-2012-0004 VMware View privilege escalation and cross-site scripting 52524 1026814 1026818 http://www.vmware.com/security/advisories/VMSA-2012-0004.html http://www.vmware.com/security/advisories/VMSA-2012-0005.html oval:org.mitre.oval:def:17183 Buffer overflow in the XPDM display driver in VMware View before 4.6.1 allows guest OS users to gain guest OS privileges via unspecified vectors. 20120316 VMSA-2012-0004 VMware View privilege escalation and cross-site scripting 52524 1026814 http://www.vmware.com/security/advisories/VMSA-2012-0004.html http://www.vmware.com/security/advisories/VMSA-2012-0005.html vmware-view-xpdm-priv-esc(74096) oval:org.mitre.oval:def:17151 Buffer overflow in the WDDM display driver in VMware ESXi 4.0, 4.1, and 5.0; VMware ESX 4.0 and 4.1; and VMware View before 4.6.1 allows guest OS users to gain guest OS privileges via unspecified vectors. 20120316 VMSA-2012-0004 VMware View privilege escalation and cross-site scripting 52524 1026814 1026818 http://www.vmware.com/security/advisories/VMSA-2012-0004.html http://www.vmware.com/security/advisories/VMSA-2012-0005.html vmware-wddm-priv-esc(74097) oval:org.mitre.oval:def:17258 Cross-site scripting (XSS) vulnerability in View Manager Portal in VMware View before 4.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted URL. 20120316 VMSA-2012-0004 VMware View privilege escalation and cross-site scripting 80118 52526 1026814 http://www.vmware.com/security/advisories/VMSA-2012-0004.html oval:org.mitre.oval:def:16664 Cross-site scripting (XSS) vulnerability in the internal browser in vSphere Client in VMware vSphere 4.1 before Update 2 and 5.0 before Update 1 allows remote attackers to inject arbitrary web script or HTML via a crafted log-file entry. 80119 48387 52525 1026817 http://www.vmware.com/security/advisories/VMSA-2012-0005.html vsphere-client-xss(74093) The Web Configuration tool in VMware vCenter Orchestrator (vCO) 4.0 before Update 4, 4.1 before Update 2, and 4.2 before Update 1 places the vCenter Server password in an HTML document, which allows remote authenticated administrators to obtain sensitive information by reading this document. 48408 52525 1026816 http://www.vmware.com/security/advisories/VMSA-2012-0005.html vcenter-config-tool-info-disc(74091) Cross-site request forgery (CSRF) vulnerability in VMware vShield Manager (vSM) 1.0.1 before Update 2 and 4.1.0 before Update 2 allows remote attackers to hijack the authentication of arbitrary users. 52525 1026815 http://www.vmware.com/security/advisories/VMSA-2012-0005.html vshield-manager-csrf(74092) VMware ESXi 3.5, 4.0, and 4.1 and ESX 3.5, 4.0, and 4.1 do not properly implement port-based I/O operations, which allows guest OS users to gain guest OS privileges by overwriting memory locations in a read-only memory block associated with the Virtual DOS Machine. 52820 1026875 TA12-164A http://www.vmware.com/security/advisories/VMSA-2012-0006.html MS12-042 vmware-esxserver-io-privilege-escalation(74480) oval:org.mitre.oval:def:15209 oval:org.mitre.oval:def:17110 The VMX process in VMware ESXi 3.5 through 4.1 and ESX 3.5 through 4.1 does not properly handle RPC commands, which allows guest OS users to cause a denial of service (memory overwrite and process crash) or possibly execute arbitrary code on the host OS via vectors involving data pointers. 53369 1027018 http://www.vmware.com/security/advisories/VMSA-2012-0009.html vmware-esxserver-rpc-priv-esc(75373) oval:org.mitre.oval:def:16810 The VMX process in VMware ESXi 4.1 and ESX 4.1 does not properly handle RPC commands, which allows guest OS users to cause a denial of service (memory overwrite and process crash) or possibly execute arbitrary code on the host OS via vectors involving function pointers. 81692 53369 1027018 http://www.vmware.com/security/advisories/VMSA-2012-0009.html vmware-rpc-commands-priv-esc(75374) oval:org.mitre.oval:def:17231 VMware Workstation 8.x before 8.0.2, VMware Player 4.x before 4.0.2, VMware Fusion 4.x before 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 use an incorrect ACL for the VMware Tools folder, which allows guest OS users to gain guest OS privileges via unspecified vectors. 81163 48782 53006 1026922 1026923 http://www.vmware.com/security/advisories/VMSA-2012-0007.html oval:org.mitre.oval:def:16745 WebKit, as used in Apple Safari before 6.0, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2012-07-25-1. APPLE-SA-2012-07-25-1 APPLE-SA-2012-09-12-1 APPLE-SA-2012-09-19-1 http://support.apple.com/kb/HT5400 http://support.apple.com/kb/HT5485 http://support.apple.com/kb/HT5503 Use-after-free vulnerability in the XML parser in Google Chrome before 18.0.1025.168 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. http://code.google.com/p/chromium/issues/detail?id=117110 http://googlechromereleases.blogspot.com/2012/04/stable-channel-update_30.html APPLE-SA-2012-07-25-1 APPLE-SA-2012-09-12-1 APPLE-SA-2012-09-19-1 81644 48992 GLSA-201205-01 http://support.apple.com/kb/HT5400 http://support.apple.com/kb/HT5485 http://support.apple.com/kb/HT5503 53309 1027001 chrome-xml-parser-code-exec(75270) oval:org.mitre.oval:def:15397 Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Cached Object Remote Code Execution Vulnerability." TA12-192A MS12-044 oval:org.mitre.oval:def:15464 Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Center Element Remote Code Execution Vulnerability." TA12-164A MS12-037 oval:org.mitre.oval:def:15579 Microsoft Internet Explorer 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Attribute Remove Remote Code Execution Vulnerability." TA12-192A MS12-044 oval:org.mitre.oval:def:15595 Heap-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.2 and 10.x before 10.1.4 on Windows and Mac OS X allows attackers to execute arbitrary code via unspecified vectors. GLSA-201308-03 http://www.adobe.com/support/security/bulletins/apsb12-16.html oval:org.mitre.oval:def:16422 Microsoft Internet Explorer 6 and 7 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not initialized or (2) is deleted, aka "Layout Memory Corruption Vulnerability." TA12-227A MS12-052 oval:org.mitre.oval:def:15240 Integer underflow in Windows Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 allows local users to gain privileges via a crafted briefcase, aka "Windows Briefcase Integer Underflow Vulnerability." Per: http://technet.microsoft.com/en-us/security/bulletin/ms12-072 "A remote code execution vulnerability exists in the Briefcase feature in Windows. An attacker could exploit the vulnerability by convincing a user to open a specially crafted briefcase.....The vulnerability cannot be exploited automatically through email. For an attack to be successful a user must open an attachment that is sent in an email message." 1027748 TA12-318A MS12-072 oval:org.mitre.oval:def:15975 Integer overflow in Windows Shell in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 allows local users to gain privileges via a crafted briefcase, aka "Windows Briefcase Integer Overflow Vulnerability." Per: http://technet.microsoft.com/security/bulletin/MS12-072 "A remote code execution vulnerability exists in the Briefcase feature in Windows. An attacker could exploit the vulnerability by convincing a user to open a specially crafted briefcase.....The vulnerability cannot be exploited automatically through email. For an attack to be successful a user must open an attachment that is sent in an email message." 1027748 TA12-318A MS12-072 oval:org.mitre.oval:def:15528 Use-after-free vulnerability in Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly initialized or (2) is deleted, aka "OnMove Use After Free Vulnerability." 55641 1027555 TA12-255A MS12-063 ms-ie-onmove-code-exec(78756) oval:org.mitre.oval:def:15852 Heap-based buffer overflow in the XSLT engine in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a PDF file containing an XSL file that triggers memory corruption when the lang function processes XML data with a crafted node-set. SUSE-SU-2013:0044 SUSE-SU-2013:0047 openSUSE-SU-2013:0138 openSUSE-SU-2013:0193 RHSA-2013:0150 GLSA-201308-03 http://www.adobe.com/support/security/bulletins/apsb13-02.html 20130108 Adobe Reader and Acrobat XSLT node() and lang() Memory Corruption Vulnerability oval:org.mitre.oval:def:16094 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier; and JavaFX 2.2 and earlier; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. Per: http://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html "Applies to client and server deployment of Java. This vulnerability can be exploited through untrusted Java Web Start applications and untrusted Java applets. It can also be exploited by supplying data to APIs in the specified Component without using untrusted Java Web Start applications or untrusted Java applets, such as through a web service." SUSE-SU-2012:1398 SUSE-SU-2012:1489 SUSE-SU-2012:1595 SSRT101042 SSRT101043 RHSA-2012:1391 RHSA-2012:1392 RHSA-2012:1465 RHSA-2012:1466 RHSA-2012:1467 RHSA-2013:1455 RHSA-2013:1456 http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/HS12-023/index.html MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html http://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html 56033 http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf http://www-01.ibm.com/support/docview.wss?uid=swg21616490 http://www-01.ibm.com/support/docview.wss?uid=swg21620037 http://www-01.ibm.com/support/docview.wss?uid=swg21621154 http://www-01.ibm.com/support/docview.wss?uid=swg21625794 http://www-01.ibm.com/support/docview.wss?uid=swg21631786 oval:org.mitre.oval:def:16546 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier and 6 Update 35 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. Per: http://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html "Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)" SUSE-SU-2012:1398 SUSE-SU-2012:1595 SSRT101042 SSRT101043 RHSA-2012:1391 RHSA-2012:1392 RHSA-2012:1466 RHSA-2012:1467 RHSA-2013:1455 RHSA-2013:1456 http://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html 56051 http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf http://www-01.ibm.com/support/docview.wss?uid=swg21616490 http://www-01.ibm.com/support/docview.wss?uid=swg21620037 http://www-01.ibm.com/support/docview.wss?uid=swg21621154 javaruntimeenvironment-deploy-cve20121532(79417) oval:org.mitre.oval:def:16556 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, and 6 Update 35 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2012-3159. Per: http://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html "Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)" SUSE-SU-2012:1398 SUSE-SU-2012:1595 SSRT101042 SSRT101043 RHSA-2012:1391 RHSA-2012:1392 RHSA-2012:1466 RHSA-2012:1467 RHSA-2013:1455 RHSA-2013:1456 http://www.oracle.com/technetwork/topics/security/javacpuoct2012-1515924.html 56046 http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf http://www-01.ibm.com/support/docview.wss?uid=swg21616490 http://www-01.ibm.com/support/docview.wss?uid=swg21620037 http://www-01.ibm.com/support/docview.wss?uid=swg21621154 javaruntimeenvironment-deploy-cve20121533(79416) oval:org.mitre.oval:def:16648 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-4167. Reason: This candidate is a reservation duplicate of CVE-2012-4167. Notes: All CVE users should reference CVE-2012-4167 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted SWF content, as exploited in the wild in August 2012 with SWF content in a Word document. openSUSE-SU-2012:0996 SUSE-SU-2012:1001 HPSBMU02948 RHSA-2012:1203 GLSA-201209-01 http://www.adobe.com/support/security/bulletins/apsb12-18.html Heap-based buffer overflow in DirectPlay in DirectX 9.0 through 11.1 in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 allows remote attackers to execute arbitrary code via a crafted Office document, aka "DirectPlay Heap Overflow Vulnerability." TA12-346A MS12-082 oval:org.mitre.oval:def:16086 Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site, aka "CFormElement Use After Free Vulnerability." 56420 1027749 TA12-318A MS12-071 oval:org.mitre.oval:def:15677 Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site, aka "CTreePos Use After Free Vulnerability." 56421 1027749 TA12-318A MS12-071 oval:org.mitre.oval:def:15886 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from a third party that the issue is due to an interaction error in between the JRE plug-in for WebKit-based browsers and the Javascript engine, which allows remote attackers to execute arbitrary code by modifying DOM nodes that contain applet elements in a way that triggers an incorrect reference count and a use after free. Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html "Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)" HPSBUX02857 SSRT101156 HPSBMU02874 RHSA-2013:0236 RHSA-2013:0237 RHSA-2013:1455 RHSA-2013:1456 VU#858729 http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html 57697 TA13-032A 20130201 Multiple Vendor WebKit JRE Plugin Module Use-after-Free Vulnerability oval:org.mitre.oval:def:16384 oval:org.mitre.oval:def:19070 oval:org.mitre.oval:def:19499 Unspecified vulnerability in the JavaFX component in Oracle Java SE JavaFX 2.2.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than other CVEs listed in the February 2013 CPU. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from a third party that the issue is due to an invalid type cast in the JSObject class. Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html "Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)" HPSBMU02874 VU#858729 http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html TA13-032A 20130201 Oracle Java SE JavaFx JSObject Invalid Type Cast Vulnerability oval:org.mitre.oval:def:16673 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-1876. Reason: This candidate is a duplicate of CVE-2012-1876. Notes: All CVE users should reference CVE-2012-1876 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, allows remote attackers to bypass Protected Mode or cause a denial of service (memory corruption) by leveraging access to a Low integrity process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012. http://arstechnica.com/business/news/2012/03/ie-9-on-latest-windows-gets-stomped-at-hacker-contest.ars http://pwn2own.zerodayinitiative.com/status.html http://twitter.com/vupen/statuses/177895844828291073 http://www.zdnet.com/blog/security/pwn2own-2012-ie-9-hacked-with-two-0day-vulnerabilities/10621 Cross-site scripting (XSS) vulnerability in Synology Photo Station 5 for DiskStation Manager (DSM) 3.2-1955 allows remote attackers to inject arbitrary web script or HTML via the name parameter to photo/photo_one.php. 20120310 Synology Photo Station 5 - Reflected Cross-Site Scripting 52416 photostation-photoone-xss(73976) SQL injection vulnerability in admin/plib/api-rpc/Agent.php in Parallels Plesk Panel 7.x and 8.x before 8.6 MU#2, 9.x before 9.5 MU#11, 10.0.x before MU#13, 10.1.x before MU#22, 10.2.x before MU#16, and 10.3.x before MU#5 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, as exploited in the wild in March 2012. http://download1.parallels.com/Plesk/PP10/parallels-plesk-panel-10-linux-updates-release-notes.html#10216 http://download1.parallels.com/Plesk/PP10/parallels-plesk-panel-10-windows-updates-release-notes.html#10216 http://kb.parallels.com/en/113321 http://www.cert.fi/haavoittuvuudet/2012/haavoittuvuus-2012-035.html http://www.h-online.com/security/news/item/Bug-in-Plesk-administration-software-is-being-actively-exploited-1446587.html [oss-security] 20120308 CVE-request: Parallels Plesk Panel admin/plib/api-rpc/Agent.php Unspecified SQL Injection 52267 1026760 plesk-unspec-unauth-access(73628) yaSSL CyaSSL before 2.0.8 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted X.509 certificate. 48634 52828 http://www.yassl.com/yaSSL/Docs-cyassl-changelog.html cyassl-x509-dos(74095) Cross-site scripting (XSS) vulnerability in the Finder module 6.x-1.x before 6.x-1.26, 7.x-1.x, and 7.x-2.x before 7.x-2.0-alpha8 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the "checkbox and radio button functionalities." http://drupal.org/node/1432318 http://drupal.org/node/1432320 http://drupalcode.org/project/finder.git/commit/13e2d0c http://drupalcode.org/project/finder.git/commit/58443aa http://www.madirish.net/content/drupal-finder-6x-19-xss-and-remote-code-execution-vulnerabilities [oss-security] 20120316 CVE-request: Drupal Finder SA-CONTRIB-2012-017 [oss-security] 20120319 Re: CVE-request: Drupal Finder SA-CONTRIB-2012-017 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) https://drupal.org/node/1432970 drupal-finder-unspecified-xss(73110) Cross-site scripting (XSS) vulnerability in administration/create_album.php in YVS Image Gallery allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. [oss-security] 20120227 Re: Case YVS Image Gallery [oss-security] 20120227 Case YVS Image Gallery [oss-security] 20120319 Re: Case YVS Image Gallery yvsimagegallery-createalbum-xsss(79529) Unspecified vulnerability in ez Publish 4.1.4, 4.2, 4.3, 4.4, 4.5, and 4.6 has unknown impact and attack vectors related to an insecure direct object reference. http://issues.ez.no/19238 [oss-security] 20120319 Re: CVE request: eZ Publish: insecure direct object reference [oss-security] 20120319 CVE request: eZ Publish: insecure direct object reference 52516 ezpublish-unspec-vuln(74060) The ExecShield feature in a certain Red Hat patch for the Linux kernel in Red Hat Enterprise Linux (RHEL) 5 and 6 and Fedora 15 and 16 does not properly handle use of many shared libraries by a 32-bit executable file, which makes it easier for context-dependent attackers to bypass the ASLR protection mechanism by leveraging a predictable base address for one of these libraries. [oss-security] 20120321 Re: CVE request -- kernel: execshield: predictable ascii armour base address http://scarybeastsecurity.blogspot.com/2012/03/some-random-observations-on-linux-aslr.html [oss-security] 20120320 Re: CVE request -- kernel: execshield: predictable ascii armour base address https://bugzilla.redhat.com/show_bug.cgi?id=804947 https://oss.oracle.com/git/?p=redpatch.git;a=commit;h=302a4fc15aebf202b6dffd6c804377c6058ee6e4 The asn1_get_length_der function in decoding.c in GNU Libtasn1 before 2.12, as used in GnuTLS before 3.0.16 and other products, does not properly handle certain large length values, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly have unspecified other impact via a crafted ASN.1 structure. 20120320 Mu Dynamics, Inc. Security Advisories MU-201202-01 and MU-201202-02 for GnuTLS and Libtasn1 [gnutls-devel] 20120316 gnutls 3.0.16 [help-libtasn1] 20120319 GNU Libtasn1 2.12 released [help-libtasn1] 20120319 minimal fix to security issue http://blog.mudynamics.com/2012/03/20/gnutls-and-libtasn1-vulns/ http://linux.oracle.com/errata/ELSA-2014-0596.html FEDORA-2012-4308 FEDORA-2012-4342 FEDORA-2012-4451 FEDORA-2012-4357 FEDORA-2012-4417 FEDORA-2012-4409 SUSE-SU-2014:0320 RHSA-2012:0427 RHSA-2012:0488 RHSA-2012:0531 48505 48578 49002 DSA-2440 http://www.gnu.org/software/gnutls/security.html MDVSA-2012:039 [oss-security] 20120320 CVE request: libtasn1 "asn1_get_length_der()" DER decoding issue [oss-security] 20120320 Re: CVE request: libtasn1 "asn1_get_length_der()" DER decoding issue [oss-security] 20120321 Re: CVE request: GnuTLS TLS record handling issue / MU-201202-01 1026829 USN-1436-1 https://bugzilla.redhat.com/show_bug.cgi?id=804920 The resolver in MaraDNS before 1.3.0.7.15 and 1.4.x before 1.4.12 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack. 80192 http://www.maradns.org/changelog.html [oss-security] 20120319 CVE request: maradns deleted domain record cache persistance flaw [oss-security] 20120320 Re: CVE request: maradns deleted domain record cache persistance flaw 1026821 https://bugzilla.redhat.com/show_bug.cgi?id=804770 maradns-domain-spoofing(74119) file before 5.11 and libmagic allow remote attackers to cause a denial of service (crash) via a crafted Composite Document File (CDF) file that triggers (1) an out-of-bounds read or (2) an invalid pointer dereference. [file] 20120221 file-5.11 is now available DSA-2422 MDVSA-2012:035 USN-2123-1 https://github.com/glensc/file/commit/1859fdb4e67c49c463c4e0078054335cd46ba295 https://github.com/glensc/file/commit/1aec04dbf8a24b8a6ba64c4f74efa0628e36db0b gnutls_cipher.c in libgnutls in GnuTLS before 2.12.17 and 3.x before 3.0.15 does not properly handle data encrypted with a block cipher, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) via a crafted record, as demonstrated by a crafted GenericBlockCipher structure. 20120320 Mu Dynamics, Inc. Security Advisories MU-201202-01 and MU-201202-02 for GnuTLS and Libtasn1 [gnutls-devel] 20120302 gnutls 2.12.16 [gnutls-devel] 20120302 gnutls 3.0.15 http://blog.mudynamics.com/2012/03/20/gnutls-and-libtasn1-vulns/ http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commit;h=422214868061370aeeb0ac9cd0f021a5c350a57d http://git.savannah.gnu.org/gitweb/?p=gnutls.git;a=commit;h=b495740f2ff66550ca9395b3fda3ea32c3acb185 FEDORA-2012-4569 FEDORA-2012-4578 SUSE-SU-2014:0320 RHSA-2012:0429 RHSA-2012:0488 RHSA-2012:0531 48511 DSA-2441 http://www.gnu.org/software/gnutls/security.html MDVSA-2012:040 [oss-security] 20120321 CVE request: GnuTLS TLS record handling issue / MU-201202-01 [oss-security] 20120321 Re: CVE request: GnuTLS TLS record handling issue / MU-201202-01 52667 1026828 USN-1418-1 https://bugzilla.redhat.com/show_bug.cgi?id=805432 The Kerberos/MapReduce security functionality in Apache Hadoop 0.20.203.0 through 0.20.205.0, 0.23.x before 0.23.2, and 1.0.x before 1.0.2, as used in Cloudera CDH CDH3u0 through CDH3u2, Cloudera hadoop-0.20-sbin before 0.20.2+923.197, and other products, allows remote authenticated users to impersonate arbitrary cluster user accounts via unspecified vectors. 20120405 [CVE-2012-1574] Apache Hadoop user impersonation vulnerability 20120405 [CVE-2012-1574] Apache Hadoop user impersonation vulnerability 52939 https://ccp.cloudera.com/display/DOC/Cloudera+Security+Bulletin https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html Multiple cross-site scripting (XSS) vulnerabilities in Cumin before r5238 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) widgets or (2) pages. RHSA-2012:0476 RHSA-2012:0477 53000 1026921 https://bugzilla.redhat.com/attachment.cgi?id=571986 https://bugzilla.redhat.com/show_bug.cgi?id=805712 cumin-redhat-unspec-xss(74844) [cumin-developers] 20120306 r5238 - in trunk: cumin/python/cumin cumin/python/cumin/grid cumin/python/cumin/inventory cumin/python/cumin/messaging rosemary/python/rosemary wooly/python/wooly The myuser_delete function in libathemecore/account.c in Atheme 5.x before 5.2.7, 6.x before 6.0.10, and 7.x before 7.0.0-beta2 does not properly clean up CertFP entries when a user is deleted, which allows remote attackers to access a different user account or cause a denial of service (daemon crash) via a login as a deleted user. 20120321 atheme.org Security Advisory ASA-2012-03-01: Improper cleanup of CertFP entries may result in undefined behaviour http://git.atheme.org/atheme/commit/?id=3d9551761db2 http://jira.atheme.org/browse/SRV-166 GLSA-201209-09 [oss-security] 20120321 atheme.org Security Advisory ASA-2012-03-01: Improper cleanup of CertFP entries may result in undefined behaviour [oss-security] 20120322 Re: atheme.org Security Advisory ASA-2012-03-01: Improper cleanup of CertFP entries may result in undefined behaviour 52675 Multiple cross-site request forgery (CSRF) vulnerabilities in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allow remote attackers to hijack the authentication of users with the block permission for requests that (1) block a user via a request to the Block module or (2) unblock a user via a request to the Unblock module. [MediaWiki-announce] 20120322 MediaWiki security and maintenance release 1.17.3 [MediaWiki-announce] 20120322 MediaWiki security and maintenance release 1.18.2 [oss-security] 20120322 MediaWiki security and maintenance release 1.18.2 [oss-security] 20120323 CVEs for MediaWiki security and maintenance release 1.18.2 52689 https://bugzilla.wikimedia.org/show_bug.cgi?id=34212 mediawiki-multiple-csrf(78911) The resource loader in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 includes private data such as CSRF tokens in a JavaScript file, which allows remote attackers to obtain sensitive information. [MediaWiki-announce] 20120322 MediaWiki security and maintenance release 1.17.3 [MediaWiki-announce] 20120322 MediaWiki security and maintenance release 1.18.2 [oss-security] 20120322 MediaWiki security and maintenance release 1.18.2 [oss-security] 20120323 CVEs for MediaWiki security and maintenance release 1.18.2 52689 https://bugzilla.wikimedia.org/show_bug.cgi?id=34907 Cross-site request forgery (CSRF) vulnerability in Special:Upload in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allows remote attackers to hijack the authentication of unspecified victims for requests that upload files. [MediaWiki-announce] 20120322 MediaWiki security and maintenance release 1.17.3 [MediaWiki-announce] 20120322 MediaWiki security and maintenance release 1.18.2 [oss-security] 20120322 MediaWiki security and maintenance release 1.18.2 [oss-security] 20120323 CVEs for MediaWiki security and maintenance release 1.18.2 52689 https://bugzilla.wikimedia.org/show_bug.cgi?id=35317 mediawiki-specialupload-csrf(74286) MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 uses weak random numbers for password reset tokens, which makes it easier for remote attackers to change the passwords of arbitrary users. [MediaWiki-announce] 20120322 MediaWiki security and maintenance release 1.17.3 [MediaWiki-announce] 20120322 MediaWiki security and maintenance release 1.18.2 [oss-security] 20120322 MediaWiki security and maintenance release 1.18.2 [oss-security] 20120323 CVEs for MediaWiki security and maintenance release 1.18.2 52689 https://bugzilla.wikimedia.org/show_bug.cgi?id=35078 mediawiki-random-numbers-sec-bypass(78910) Cross-site scripting (XSS) vulnerability in the wikitext parser in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allows remote attackers to inject arbitrary web script or HTML via a crafted page with "forged strip item markers," as demonstrated using the CharInsert extension. [MediaWiki-announce] 20120322 MediaWiki security and maintenance release 1.17.3 [MediaWiki-announce] 20120322 MediaWiki security and maintenance release 1.18.2 [oss-security] 20120322 MediaWiki security and maintenance release 1.18.2 [oss-security] 20120323 CVEs for MediaWiki security and maintenance release 1.18.2 52689 https://bugzilla.wikimedia.org/show_bug.cgi?id=35315 mediawiki-wikitext-xss(74288) Double free vulnerability in the xfrm6_tunnel_rcv function in net/ipv6/xfrm6_tunnel.c in the Linux kernel before 2.6.22, when the xfrm6_tunnel module is enabled, allows remote attackers to cause a denial of service (panic) via crafted IPv6 packets. http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d0772b70faaf8e9f2013b6c4273d94d5eac8047a SSRT100852 RHSA-2012:0488 53139 1026930 https://bugzilla.redhat.com/show_bug.cgi?id=752304 https://github.com/torvalds/linux/commit/d0772b70faaf8e9f2013b6c4273d94d5eac8047a Integer overflow in the mid function in toolkit/tbytevector.cpp in TagLib 1.7 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a crafted file header field in a media file, which triggers a large memory allocation. [pipermail] 20120304 multiple security vulnerabilities in taglib [pipermail] 20120305 multiple security vulnerabilities in taglib GLSA-201206-16 [oss-security] 20120305 Re: CVE-Request taglib vulnerabilities [oss-security] 20120321 Re: CVE-Request taglib vulnerabilities [oss-security] 20120326 Re: CVE-Request taglib vulnerabilities 52290 taglib-mid-dos(78909) https://github.com/taglib/taglib/commit/dcdf4fd954e3213c355746fa15b7480461972308 OpenStack Compute (Nova) Essex before 2011.3 allows remote authenticated users to cause a denial of service (Nova-API log file and disk consumption) via a long server name. FEDORA-2012-5026 [Openstack] 20120329 [OSSA 2012-003] Long server names grow nova-api log files significantly (CVE-2012-1585) https://bugs.launchpad.net/nova/+bug/962515 mount.cifs in cifs-utils 2.6 allows local users to determine the existence of arbitrary files or directories via the file path in the second argument, which reveals their existence in an error message. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=665923 SUSE-SU-2012:0575 [oss-security] 20120327 CVE id request: cifs-utils [oss-security] 20120327 Re: CVE id request: cifs-utils https://bugzilla.samba.org/show_bug.cgi?id=8821 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2011-4944. Reason: This candidate is a duplicate of CVE-2011-4944. Notes: All CVE users should reference CVE-2011-4944 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Algorithmic complexity vulnerability in the _filter_url function in the text filtering system (modules/filter/filter.module) in Drupal 7.x before 7.14 allows remote authenticated users with certain roles to cause a denial of service (CPU consumption) via a long email address. http://drupal.org/drupal-7.14 http://drupal.org/node/1557938 http://drupal.org/node/1558468 http://drupalcode.org/project/drupal.git/commit/db79496ae983447506f016a20738c3d7e5d059fa MDVSA-2013:074 53368 Open redirect vulnerability in the Form API in Drupal 7.x before 7.13 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via crafted parameters in a destination URL. http://drupal.org/node/1557938 JVN#45898075 JVNDB-2012-000045 MDVSA-2013:074 53365 The forum list in Drupal 7.x before 7.14 does not properly check user permissions for unpublished forum posts, which allows remote authenticated users to obtain sensitive information such as the post title via the forum overview page. http://drupal.org/drupal-7.14 http://drupal.org/node/1302404 http://drupal.org/node/1557938 http://drupalcode.org/project/drupal.git/commit/352645e4a636cadeb5576231b3547972eebdd8e5 MDVSA-2013:074 53359 The image module in Drupal 7.x before 7.14 does not properly check permissions when caching derivative image styles of private images, which allows remote attackers to read private image styles. http://drupal.org/drupal-7.14 http://drupal.org/node/1507988 http://drupal.org/node/1557938 http://drupalcode.org/project/drupal.git/commit/3bf6761ff7537dc68e22ea73f155134f3cfd41a8 MDVSA-2013:074 53359 epan/dissectors/packet-ansi_a.c in the ANSI A dissector in Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed packet. Per: http://cwe.mitre.org/data/definitions/476.html 'CWE-476: NULL Pointer Dereference' http://anonsvn.wireshark.org/viewvc?view=revision&revision=40962 FEDORA-2012-5256 FEDORA-2012-5243 openSUSE-SU-2012:0558 48548 18758 [oss-security] 20120328 Re: CVE Request: Multiple wireshark security flaws resolved in 1.4.12 and 1.6.6 1026874 http://www.wireshark.org/security/wnpa-sec-2012-04.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6823 wireshark-ansia-dos(74361) oval:org.mitre.oval:def:14991 epan/dissectors/packet-ieee80211.c in the IEEE 802.11 dissector in Wireshark 1.6.x before 1.6.6 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. http://anonsvn.wireshark.org/viewvc?view=revision&revision=40967 FEDORA-2012-5243 48548 [oss-security] 20120328 Re: CVE Request: Multiple wireshark security flaws resolved in 1.4.12 and 1.6.6 52738 1026874 http://www.wireshark.org/security/wnpa-sec-2012-05.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6809 wireshark-ieee-dos(74362) oval:org.mitre.oval:def:15244 The pcap_process_pseudo_header function in wiretap/pcap-common.c in Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6 allows remote attackers to cause a denial of service (application crash) via a WTAP_ENCAP_ERF file containing an Extension or Multi-Channel header with an invalid pseudoheader size, related to the pcap and pcap-ng file parsers. http://anonsvn.wireshark.org/viewvc?view=revision&revision=41008 FEDORA-2012-5256 FEDORA-2012-5243 openSUSE-SU-2012:0558 48548 [oss-security] 20120328 Re: CVE Request: Multiple wireshark security flaws resolved in 1.4.12 and 1.6.6 52737 1026874 http://www.wireshark.org/news/20120327.html http://www.wireshark.org/security/wnpa-sec-2012-06.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6804 wireshark-pcap-dos(74364) oval:org.mitre.oval:def:15548 The mp2t_process_fragmented_payload function in epan/dissectors/packet-mp2t.c in the MP2T dissector in Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6 allows remote attackers to cause a denial of service (application crash) via a packet containing an invalid pointer value that triggers an incorrect memory-allocation attempt. http://anonsvn.wireshark.org/viewvc?view=revision&revision=41001 FEDORA-2012-5256 FEDORA-2012-5243 openSUSE-SU-2012:0558 48548 [oss-security] 20120328 Re: CVE Request: Multiple wireshark security flaws resolved in 1.4.12 and 1.6.6 52736 1026874 http://www.wireshark.org/security/wnpa-sec-2012-07.html https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6833 wireshark-mp2t-dos(74363) oval:org.mitre.oval:def:15194 Cross-site scripting (XSS) vulnerability in the textEncode function in classes/ezjscajaxcontent.php in eZ JS Core in eZ Publish before 1.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://share.ez.no/community-project/security-advisories/ezsa-2012-006-xss-exploit-on-ezjscore-run-command-when-using-firefox [oss-security] 20120511 CVE-2012-1597: XSS in eZ Publish https://github.com/ezsystems/ezjscore/commit/58854564c7b8672090c25c4b1677d08620d870f2 Joomla! 1.5.x before 1.5.26 has unspecified impact and attack vectors related to "insufficient randomness" and a "password reset vulnerability." http://developer.joomla.org/security/news/396-20120305-core-password-change.html [oss-security] 20120328 Re: CVE-request: Joomla 20120305 / 20120306 [oss-security] 20120827 Re: CVE request: joomla before 1.5.26 password change Joomla! 1.5.x before 1.5.26 does not properly check permissions, which allows attackers to obtain sensitive "administrative back end information" via unknown vectors. NOTE: this might be a duplicate of CVE-2012-1611. http://developer.joomla.org/security/news/397-20120306-core-information-disclosure.html [oss-security] 20120328 Re: CVE-request: Joomla 20120305 / 20120306 Multiple cross-site scripting (XSS) vulnerabilities in functions.php in phpPgAdmin before 5.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) type of a function. openSUSE-SU-2012:0493 http://sourceforge.net/p/phppgadmin/mailman/message/28783470/ [oss-security] 20120328 CVE request: phppgadmin before 5.0.4 XSS [oss-security] 20120328 Re: CVE request: phppgadmin before 5.0.4 XSS [oss-security] 20120330 Re: CVE request: phppgadmin before 5.0.4 XSS http://www.postgresql.org/message-id/4F6B447C.6080204@dalibo.com 52761 https://bugzilla.redhat.com/show_bug.cgi?id=808439 phppgadmin-function-xss(74440) https://github.com/phppgadmin/phppgadmin/commit/74174ad639664b52cc1609ede0af8bc403e98a00 https://github.com/phppgadmin/phppgadmin/commit/e92a003624609a445c4cf57c9c3d1fcef0eae47c#diff-0 The KVM implementation in the Linux kernel before 3.3.6 allows host OS users to cause a denial of service (NULL pointer dereference and host OS crash) by making a KVM_CREATE_IRQCHIP ioctl call after a virtual CPU already exists. openSUSE-SU-2013:0925 RHSA-2012:0571 RHSA-2012:0676 DSA-2469 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.3.6 [oss-security] 20120329 Re: CVE request -- kernel: kvm: irqchip_in_kernel() and vcpu->arch.apic inconsistency 1026897 https://bugzilla.redhat.com/show_bug.cgi?id=808199 https://github.com/torvalds/linux/commit/9c895160d25a76c21b65bad141b08e8d4f99afef SUSE-SU-2012:1679 user.php in NextBBS 0.6 allows remote attackers to bypass authentication and gain administrator access by setting the userkey cookie to 1. 20120327 [waraxe-2012-SA#080] - Multiple Vulnerabilities in NextBBS 0.6.0 http://packetstormsecurity.org/files/111250/NextBBS-0.6.0-Authentication-Bypass-SQL-Injection-XSS.html [oss-security] 20120329 CVE-request: NextBBS 0.6.0 waraxe-2012-SA#080 [oss-security] 20120329 Re: CVE-request: NextBBS 0.6.0 waraxe-2012-SA#080 52728 http://www.waraxe.us/advisory-80.html Multiple SQL injection vulnerabilities in ajaxserver.php in NextBBS 0.6 allow remote attackers to execute arbitrary SQL commands via the (1) curstr parameter in the findUsers function, (2) id parameter in the isIdAvailable function, or (3) username parameter in the getGreetings function. 20120327 [waraxe-2012-SA#080] - Multiple Vulnerabilities in NextBBS 0.6.0 http://packetstormsecurity.org/files/111250/NextBBS-0.6.0-Authentication-Bypass-SQL-Injection-XSS.html [oss-security] 20120329 CVE-request: NextBBS 0.6.0 waraxe-2012-SA#080 [oss-security] 20120329 Re: CVE-request: NextBBS 0.6.0 waraxe-2012-SA#080 52728 http://www.waraxe.us/advisory-80.html Cross-site scripting (XSS) vulnerability in NextBBS 0.6 allows remote attackers to inject arbitrary web script or HTML via the do parameter to index.php. 20120327 [waraxe-2012-SA#080] - Multiple Vulnerabilities in NextBBS 0.6.0 http://packetstormsecurity.org/files/111250/NextBBS-0.6.0-Authentication-Bypass-SQL-Injection-XSS.html [oss-security] 20120329 CVE-request: NextBBS 0.6.0 waraxe-2012-SA#080 [oss-security] 20120329 Re: CVE-request: NextBBS 0.6.0 waraxe-2012-SA#080 52728 http://www.waraxe.us/advisory-80.html The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize arbitrary objects and possibly execute arbitrary code via vectors related to "a missing signature (HMAC) for a request argument." http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001/ [oss-security] 20120329 Re: CVE request: TYPO3-CORE-SA-2012-001 52771 Multiple cross-site scripting (XSS) vulnerabilities in the Backend component in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified vectors. http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001/ DSA-2445 [oss-security] 20120329 Re: CVE request: TYPO3-CORE-SA-2012-001 52771 The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to obtain the database name via a direct request. http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001/ DSA-2445 [oss-security] 20120329 Re: CVE request: TYPO3-CORE-SA-2012-001 52771 The t3lib_div::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote attackers to bypass the cross-site scripting (XSS) protection mechanism and inject arbitrary web script or HTML via non printable characters. http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-001/ DSA-2445 [oss-security] 20120329 Re: CVE request: TYPO3-CORE-SA-2012-001 52771 Integer overflow in the GetEXIFProperty function in magick/property.c in ImageMagick before 6.7.6-4 allows remote attackers to cause a denial of service (out-of-bounds read) via a large component count for certain EXIF tags in a JPEG image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0259. openSUSE-SU-2012:0692 USN-1435-1 DSA-2462 http://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=20629 [oss-security] 20120404 CVE-2012-1610 assignment notification: ImageMagick insufficient patch for CVE-2012-0259 52898 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-0259 imagemagick-getexifproperty-dos(74660) Joomla! 2.5.x before 2.5.4 does not properly check permissions, which allows attackers to obtain sensitive "administrative back end" information via unknown attack vectors. NOTE: this might be a duplicate of CVE-2012-1599. http://developer.joomla.org/security/news/398-20120307-core-information-disclosure.html [oss-security] 20120403 CVE-request: Joomla 2012-04 398-20120307 399-20120308 [oss-security] 20120403 Re: CVE-request: Joomla 2012-04 398-20120307 399-20120308 Cross-site scripting (XSS) vulnerability in the update manager in Joomla! 2.5.x before 2.5.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://developer.joomla.org/security/news/399-20120308-core-xss-vulnerability.html [oss-security] 20120403 CVE-request: Joomla 2012-04 398-20120307 399-20120308 [oss-security] 20120403 Re: CVE-request: Joomla 2012-04 398-20120307 399-20120308 52859 Cross-site scripting (XSS) vulnerability in edit_one_pic.php in Coppermine Photo Gallery before 1.5.20 allows remote authenticated users with certain privileges to inject arbitrary web script or HTML via the keywords parameter. 20120329 [waraxe-2012-SA#081] - Multiple Vulnerabilities in Coppermine 1.5.18 http://coppermine.svn.sourceforge.net/viewvc/coppermine/trunk/cpg1.6.x/edit_one_pic.php?r1=8348&r2=8354 http://forum.coppermine-gallery.net/index.php/topic,74682.0.html http://packetstormsecurity.org/files/111369/Coppermine-1.5.18-Cross-Site-Scripting-Path-Disclosure.html 18680 [oss-security] 20120330 CVE-request: Coppermine 1.5.18 waraxe-2012-SA#081 [oss-security] 20120330 Re: CVE-request: Coppermine 1.5.18 waraxe-2012-SA#081 [oss-security] 20120403 Re: CVE-request: Coppermine 1.5.18 waraxe-2012-SA#081 52818 http://www.waraxe.us/advisory-81.html Coppermine Photo Gallery before 1.5.20 allows remote attackers to obtain sensitive information via (1) a direct request to plugins/visiblehookpoints/index.php, an invalid (2) page or (3) cat parameter to thumbnails.php, an invalid (4) page parameter to usermgr.php, or an invalid (5) newer_than or (6) older_than parameter to search.inc.php, which reveals the installation path in an error message. 20120329 [waraxe-2012-SA#081] - Multiple Vulnerabilities in Coppermine 1.5.18 http://coppermine.svn.sourceforge.net/viewvc/coppermine/trunk/cpg1.6.x/edit_one_pic.php?r1=8348&r2=8354 http://forum.coppermine-gallery.net/index.php/topic,74682.0.html http://packetstormsecurity.org/files/111369/Coppermine-1.5.18-Cross-Site-Scripting-Path-Disclosure.html 18680 [oss-security] 20120330 CVE-request: Coppermine 1.5.18 waraxe-2012-SA#081 [oss-security] 20120330 Re: CVE-request: Coppermine 1.5.18 waraxe-2012-SA#081 [oss-security] 20120403 Re: CVE-request: Coppermine 1.5.18 waraxe-2012-SA#081 52818 http://www.waraxe.us/advisory-81.html Use-after-free vulnerability in icclib before 2.13, as used by Argyll CMS before 1.4 and possibly other programs, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted ICC profile file. FEDORA-2012-6529 GLSA-201206-04 http://www.argyllcms.com/icc_readme.html 53240 https://bugzilla.redhat.com/show_bug.cgi?id=809697 argyll-icc-code-execution(75162) Directory traversal vulnerability in combine.php in OSClass before 2.3.6 allows remote attackers to read and write arbitrary files via a .. (dot dot) in the type parameter. NOTE: this vulnerability can be leveraged to upload arbitrary files. 20120307 OSClass directory traversal (leads to arbitrary file upload) http://osclass.org/2012/03/05/osclass-2-3-6/ http://www.codseq.it/advisories/osclass_directory_traversal_vulnerability [oss-security] 20120402 CVE request: OSClass directory traversal vulnerability [oss-security] 20120402 Re: CVE request: OSClass directory traversal vulnerability [oss-security] 20120403 Re: CVE request: OSClass directory traversal vulnerability [oss-security] 20120404 Re: CVE request: OSClass directory traversal vulnerability 52336 osclass-directory-traversal(73754) osclass-file-upload(73755) https://github.com/osclass/OSClass/commit/1e7626f4e1a26371480989c0b937f107ea9a6d4b https://github.com/osclass/OSClass/commit/a40b76695994442644e46e1b776d79660500566a https://github.com/osclass/OSClass/commit/ff7ef8a97301aaaf6a97fe46c2c27981a86b4e2f#diff-1 Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standard_conforming_strings" option enabled, such as the default configuration of PostgreSQL 9.1, does not properly escape unspecified JDBC statement parameters, which allows remote attackers to perform SQL injection attacks. NOTE: as of 20120330, it was claimed that the upstream developer planned to dispute this issue, but an official dispute has not been posted as of 20121005. 20120325 SQL injection attack possible when connecting to PostgreSQL 9.1 with version 8.1 JDBC driver [opensuse-security] 20120325 SQL injection attack possible when connecting to PostgreSQL 9.1 with version 8.1 JDBC driver [oss-security] 20120330 CVE DISPUTE notification: postgresql-jdbc: SQL injection due improper escaping of JDBC statement parameters [oss-security] 20120330 postgresql-jdbc 8.1 SQL injection with postgresql server 9.1 [oss-security] 20120331 SQL injection attack possible when connecting to PostgreSQL 9.1 with version 8.1 JDBC driver [oss-security] 20120402 Re: [JDBC] CVE DISPUTE notification: postgresql-jdbc: SQL injection due improper escaping of JDBC statement parameters [oss-security] 20120404 Re: CVE DISPUTE notification: postgresql-jdbc: SQL injection due improper escaping of JDBC statement parameters [oss-security] 20120404 Re: Re: [pgsql-security] postgresql-jdbc 8.1 SQL injection with postgresql server 9.1 [oss-security] 20120404 Re: Re: [JDBC] CVE DISPUTE notification: postgresql-jdbc: SQL injection due improper escaping of JDBC statement parameters [oss-security] 20120404 Re: CVE DISPUTE notification: postgresql-jdbc: SQL injection due improper escaping of JDBC statement parameters https://bugzilla.novell.com/show_bug.cgi?id=754273 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none. slock 0.9 does not properly handle the XRaiseWindow event when the screen is locked, which might allow physically proximate attackers to obtain sensitive information by pressing a button, which reveals the desktop and active windows. http://hg.suckless.org/slock/rev/891a4984aba6 [oss-security] 20120405 CVE Request: slock-0.9 displays modal box after locking [oss-security] 20120405 Re: CVE Request: slock-0.9 displays modal box after locking 52922 https://bugs.gentoo.org/show_bug.cgi?id=401645 https://bugzilla.redhat.com/show_bug.cgi?id=786310 slock-xraisewindow-sec-bypass(74666) Multiple cross-site scripting (XSS) vulnerabilities in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.02 allow remote attackers to inject arbitrary web script or HTML via (1) a parameter array in freemarker templates, the (2) contentId or (3) mapKey parameter in a cms event request, which are not properly handled in an error message, or unspecified input in (4) an ajax request to the getServerError function in checkoutProcess.js or (5) a Webslinger component request. NOTE: some of these details are obtained from third party information. [ofbiz-dev] 20120415 [CVE-2012-1621] Apache OFBiz information disclosure vulnerability [www-announce] 20120415 Apache OFBiz 10.04.02 released http://ofbiz.apache.org/download.html#vulnerabilities 20120415 [CVE-2012-1621] Apache OFBiz information disclosure vulnerability 20120415 [CVE-2012-1621] Apache OFBiz information disclosure vulnerability 53023 1026927 apache-ofbiz-multiple-xss(74870) Apache OFBiz 10.04.x before 10.04.02 allows remote attackers to execute arbitrary code via unspecified vectors. [ofbiz-user] 20120415 [CVE-2012-1622] Apache OFBiz information disclosure vulnerability http://ofbiz.apache.org/download.html#security The Registration Codes module before 6.x-2.4 for Drupal does not restrict access to the registration code list, which might allow remote attackers to bypass intended registration restrictions. http://drupal.org/node/1394172 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 51271 Multiple cross-site scripting (XSS) vulnerabilities in the Lingotek module 6.x-1.x before 6.x-1.40 for Drupal allow remote authenticated users to inject arbitrary web script or HTML when (1) creating or (2) editing page content. http://drupal.org/node/1394220 http://drupal.org/node/1394412 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 51272 lingotek-createedit-xss(72151) Eval injection vulnerability in the fillpdf_form_export_decode function in fillpdf.admin.inc in the Fill PDF module 6.x-1.x before 6.x-1.16 and 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with administer PDFs privileges to execute arbitrary PHP code via unspecified vectors. NOTE: Some of these details are obtained from third party information. http://drupal.org/node/1394428 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 51288 SQL injection vulnerability in the conversion form for Events in the Date module 6.x-2.x before 6.x-2.8 for Drupal allows remote authenticated users with the "administer Date Tools" privilege to execute arbitrary SQL commands via unspecified vectors. http://drupal.org/node/1401026 http://drupal.org/node/1401434 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 51378 date-event-sql-injection(72356) Cross-site scripting (XSS) vulnerability in vud_term.module in the Vote Up/Down module 6.x-2.x before 6.x-2.8 and 6.x-3.x before 6.x-3.1 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via taxonomy terms. http://drupal.org/node/1400528 http://drupal.org/node/1400530 http://drupal.org/node/1401580 http://drupalcode.org/project/vote_up_down.git/commit/fe83aa4b8fa44d83a01494870a80d4651434f4c0 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 51376 Cross-site scripting (XSS) vulnerability in the SuperCron module for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. http://drupal.org/node/1401644 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) supercron-unspecified-xss(72389) Cross-site scripting (XSS) vulnerability in the Taxotouch module for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors. http://drupal.org/node/1401644 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 51387 taxinomynavigator-unspecified-xss(72387) Cross-site scripting (XSS) vulnerability in the Taxonomy Navigator module for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors. http://drupal.org/node/1401644 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 51387 taxinomynavigator-unspecified-xss(72387) Cross-site request forgery (CSRF) vulnerability in the Admin:hover module for Drupal allows remote attackers to hijack the authentication of administrators for requests that unpublish all nodes, and possibly other actions, via unspecified vectors. http://drupal.org/node/1401644 http://drupal.org/node/1407206 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 51388 adminhover-unspecified-csrf(72386) Cross-site scripting (XSS) vulnerability in password_policy.admin.inc in the Password Policy module before 6.x-1.4 and 7.x-1.0 beta3 for Drupal allows remote authenticated users with administer policies permissions to inject arbitrary web script or HTML via the name parameter. http://drupal.org/node/1401678 http://drupalcode.org/project/password_policy.git/commit/3c688c3b4a3ed96fdc4b89883595633338c7ebb6 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 51385 Cross-site request forgery (CSRF) vulnerability in the Password Policy module before 6.x-1.4 and 7.x-1.0 beta3 for Drupal allows remote attackers to hijack the authentication of administrative users for requests that unblock a user. http://drupal.org/node/1401678 http://drupalcode.org/project/password_policy.git/commit/3c688c3b4a3ed96fdc4b89883595633338c7ebb6 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 51385 Cross-site scripting (XSS) vulnerability in video_filter.codecs.inc in the Video Filter module 6.x-2.x and 7.x-2.x for Drupal allows remote attackers to inject arbitrary web script or HTML via the EMBEDLOOKUP parameter for Blip.tv links. http://drupal.org/node/1401838 http://drupalcode.org/project/video_filter.git/commit/49680a6 http://drupalcode.org/project/video_filter.git/commit/c90c86e http://justin.madirish.net/content/drupal-video-filter-6x-28-xss-vulnerability [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 51381 videofilter-unspecified-xss(72359) The hook_node_access function in the revisioning module 7.x-1.x before 7.x-1.3 for Drupal checks the permissions of the current user even when it is called to check permissions of other users, which allows remote attackers to bypass intended access restrictions, as demonstrated when using the XML sitemap module to obtain sensitive information about unpublished content. http://drupal.org/node/1407456 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) https://drupal.org/node/1409268 Cross-site request forgery (CSRF) vulnerability in the stickynote module before 7.x-1.1 for Drupal allows remote attackers to hijack the authentication of users for requests that delete stickynotes via unspecified vectors. http://drupal.org/node/1408556 http://drupal.org/node/1409422 http://drupalcode.org/project/stickynote.git/commit/9a7b535 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) SQL injection vulnerability in the Search Autocomplete module before 7.x-2.1 for Drupal allows remote authenticated users with the "use search_autocomplete" permission to execute arbitrary SQL commands via unspecified vectors. http://drupal.org/node/1410674 http://drupal.org/node/1416612 http://drupalcode.org/project/search_autocomplete.git/commit/589e8f6 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 51667 Multiple cross-site scripting (XSS) vulnerabilities in product/commerce_product.module in the Drupal Commerce module for Drupal before 7.x-1.2 allow remote authenticated users to inject arbitrary web script or HTML via the (1) sku or (2) title parameters. http://drupal.org/node/1416824 http://drupalcode.org/project/commerce.git/blobdiff/45bc53875f1675750afe60e709a34c95e3008366..b74cdcd:/modules/product/commerce_product.module [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 51668 drupal-commerce-multiple-xss(72743) Multiple cross-site scripting (XSS) vulnerabilities in the Managesite module 6.x-1.x before 6.1-1.1 for Drupal allow remote authenticated users with "administer managesite" permissions to inject arbitrary web script or HTML via the title parameter when (1) adding or (2) updating a category. http://drupal.org/node/1417000 http://drupalcode.org/project/managesite.git/blobdiff/7dd99c47d891d482be1430d3c06a5bb0f6c74d85..7051b7e:/managesite.module [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 51669 drupal-managesite-category-xss(72742) The finder_import function in the Finder module 6.x-1.x before 6.x-1.26, 7.x-1.x, and 7.x-2.x before 7.x-2.0-alpha8 for Drupal allows remote authenticated users with the administer finder permission to execute arbitrary PHP code via admin/build/finder/import. http://drupal.org/node/1432318 http://drupal.org/node/1432320 http://drupalcode.org/project/finder.git/commit/bc0cc82 http://www.madirish.net/content/drupal-finder-6x-19-xss-and-remote-code-execution-vulnerabilities [oss-security] 20120316 CVE-request: Drupal Finder SA-CONTRIB-2012-017 [oss-security] 20120319 Re: CVE-request: Drupal Finder SA-CONTRIB-2012-017 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) https://drupal.org/node/1432970 includes/linkchecker.pages.inc in the Link checker module 6.x-2.x before 6.x-2.5 for Drupal does not properly enforce access permissions on broken links, which allows remote attackers to obtain sensitive information via unspecified vectors. http://drupal.org/node/1440508 http://drupalcode.org/project/linkchecker.git/commit/fef0ddf [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) https://drupal.org/node/1441252 The Faster Permissions module 7.x-2.x before 7.x-1.2 for Drupal does not check the "administer permissions" permission, which allows remote attackers to modify access permissions via unspecified vectors. http://drupal.org/node/1441556 http://drupalcode.org/project/fp.git/commitdiff/39e7587 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) https://drupal.org/node/1441448 The Organic Groups (OG) Vocabulary module 6.x-1.x before 6.x-1.2 for Drupal allows remote authenticated users with certain administrator permissions to modify the vocabularies of other groups via unspecified vectors. http://drupal.org/node/1441086 http://drupalcode.org/project/og_vocab.git/commitdiff/cd8de08 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) https://drupal.org/node/1441450 ogvocabulary-title-xss(53902) The CDN module 6.x-2.2 and 7.x-2.2 for Drupal, when running in Origin Pull mode with the "Far Future expiration" option enabled, allows remote attackers to read arbitrary PHP files via unspecified vectors, as demonstrated by reading settings.php. http://drupal.org/node/1441480 http://drupal.org/node/1441482 http://drupalcode.org/project/cdn.git/commitdiff/cd2a5ff http://drupalcode.org/project/cdn.git/commitdiff/eca85e6 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) https://drupal.org/node/1441502 Multiple cross-site scripting (XSS) vulnerabilities in the FAQ module 6.x-1.x before 6.x-1.13 and 7.x-1.x-rc1 for Drupal allow remote authenticated users to inject arbitrary web script or HTML via the (1) title parameter in faq.admin.inc or (2) detailed_question parameter in faq.module. http://drupal.org/node/1451194 http://drupalcode.org/project/faq.git/blobdiff/2991dd94e70a2881571a4b777645f4dcc42c1f10..912f1d2:/faq.module http://drupalcode.org/project/faq.git/blobdiff/525fb85e5a43cb6cfe3028aa88eaf8a6e40548d5..f381756:/faq.admin.inc http://drupalcode.org/project/faq.git/commit/912f1d2 http://drupalcode.org/project/faq.git/commit/f381756 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 52126 drupal-faq-unspecified-xss(73452) Multiple cross-site scripting (XSS) vulnerabilities in the "stand alone PHP application for the OSM Player," as used in the MediaFront module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.5 for Drupal, allow remote attackers to inject arbitrary web script or HTML via (1) $_SERVER['HTTP_HOST'] or (2) $_SERVER['SCRIPT_NAME'] to players/osmplayer/player/OSMPlayer.php, (3) playlist parameter to players/osmplayer/player/getplaylist.php, and possibly other vectors related to $_SESSION. http://drupalcode.org/project/mediafront.git/commitdiff/6300750 http://drupalcode.org/project/mediafront.git/commitdiff/b3857aa [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 52229 https://drupal.org/node/1460892 https://drupal.org/node/1460894 https://drupal.org/node/1461424 mediafront-phplibrary-xss(73606) Cross-site scripting (XSS) vulnerability in the Cool Aid module before 6.x-1.9 for Drupal allows remote authenticated users with the administer coolaid permission to inject arbitrary web script or HTML via unspecified vectors. http://drupal.org/node/1417186 http://drupal.org/node/1461438 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 52232 coolaid-helpmessages-xss(73607) Cool Aid module before 6.x-1.9 for Drupal does not enforce access restrictions, which allows remote authenticated users with the administer coolaid permission to modify arbitrary pages via unspecified vectors. http://drupal.org/node/1417186 http://drupal.org/node/1461438 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 52232 coolaid-helpmessages-security-bypass(73608) The ZipCart module 6.x before 6.x-1.4 for Drupal checks the "access content" permission instead of the "access ZipCart downloads" permission when building archives, which allows remote authenticated users with access content permission to bypass intended access restrictions. http://drupalcode.org/project/zipcart.git/commitdiff/fe143c2 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 52231 https://drupal.org/node/1460892 https://drupal.org/node/1461446 zipcart-archives-security-bypass(73609) Cross-site scripting (XSS) vulnerability in the Submenu Tree module before 6.x-1.5 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. http://drupal.org/node/1132838 http://drupal.org/node/1461470 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 52226 Cross-site scripting (XSS) vulnerability in the Hierarchical Select module 6.x-3.x before 6.x-3.8 for Drupal allows remote authenticated users with administer taxonomy permissions to inject arbitrary web script or HTML via unspecified vectors related to "the vocabulary's help text." http://drupal.org/node/1461318 http://drupal.org/node/1461724 http://drupalcode.org/project/hierarchical_select.git/commit/be32dceb17d25553e474c295a8c3db69eab95cee [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 52228 hierarchicalselect-textvocabularies-xss(73611) Cross-site scripting (XSS) vulnerability in the Taxonomy Views Integrator (TVI) module 6.x-1.x before 6.x-1.3 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, related to "views pages." http://drupal.org/node/1306946 http://drupal.org/node/1461892 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 52227 taxonomyviews-viewpages-xss(73612) Multiple cross-site scripting (XSS) vulnerabilities in the Data module 6.x-1.x before 6.x-1.0 and 7.x-1.x before 7.x-1.0-alpha3 for Drupal allow remote authenticated users with the administer data tables permission to inject arbitrary web script or HTML via the title parameter in (1) data.views.inc and (2) data_ui/data_ui.admin.inc. http://drupal.org/node/1470980 http://drupal.org/node/1470982 http://drupal.org/node/1471780 http://drupalcode.org/project/data.git/commit/33f0caa http://drupalcode.org/project/data.git/commit/6f6858a http://www.madirish.net/content/drupal-data-6x-10-xss-vulnerability [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 52337 Unspecified vulnerability in the UC PayDutchGroup / WeDeal payment module 6.x-1.0 for Drupal allows remote authenticated users to obtain account credentials via unknown attack vectors. http://drupal.org/node/1471800 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 52344 ucpaydutch-unspec-information-disclsoure(73897) SQL injection vulnerability in the Multisite Search module 6.x-2.2 for Drupal allows remote authenticated users with certain permissions to execute arbitrary SQL commands via the Site table prefix field. http://drupal.org/node/1471800 http://www.madirish.net/content/drupal-multisite-search-module-sql-injection-vulnerability [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 52342 multisite-unspecified-sql-injection(73898) Cross-site scripting (XSS) vulnerability in block_class.module in the Block Class module before 7.x-1.1 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the class name. http://drupal.org/node/1471090 http://drupal.org/node/1471808 http://drupalcode.org/project/block_class.git/commit/9a5205d [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 52341 blockclass-addmod-class-xss(73776) Cross-site scripting (XSS) vulnerability in the Read More Link module 6.x-3.x before 6.x-3.1 for Drupal allows remote authenticated users with the access administration pages permission to inject arbitrary web script or HTML via unspecified vectors. http://drupal.org/node/1471080 http://drupal.org/node/1471822 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 52340 readmorelink-editadministrationpages-xss(73777) Cross-site scripting (XSS) vulnerability in the Node Recommendation module 6.x-1.x before 6.x-1.1 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors. http://drupal.org/node/1471906 http://drupal.org/node/1471940 http://drupalcode.org/project/noderecommendation.git/commit/55567d0 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 52343 noderecommendation-unspecified-xss(73778) Multiple cross-site scripting (XSS) vulnerabilities in components/select.inc in the Webform module 6.x-3.x before 6.x-3.17 and 7.x-3.x before 7.x-3.17 for Drupal, when the "Select (or other)" module is enabled, allow remote authenticated users with the create webform content permission to inject arbitrary web script or HTML via vectors related to (1) checkboxes or (2) radios. http://drupal.org/node/1472178 http://drupal.org/node/1472180 http://drupal.org/node/1472214 http://drupalcode.org/project/webform.git/commit/90af819 http://drupalcode.org/project/webform.git/commit/917fa91 [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) 52345 drupal-webform-unspecified-xss-var2(73779) ESRI ArcMap 9 and ArcGIS 10.0.2.3200 and earlier does not properly prompt users before executing embedded VBA macros, which allows user-assisted remote attackers to execute arbitrary VBA code via a crafted map (.mxd) file. http://packetstormsecurity.org/files/113644/ESRI-ArcMap-Arbitrary-Code-Execution.html http://www.cs.umb.edu/~joecohen/exploits/CVE-2012-1661/ 19138 1027170 CA ARCserve Backup r12.0 through SP2, r12.5 before SP2, r15 through SP1, and r16 before SP1 on Windows allows remote attackers to cause a denial of service (service shutdown) via a crafted network request. 20120321 CA20120320-01: Security Notice for CA ARCserve Backup 80212 48459 52655 1026832 arcserve-traffic-dos(74175) https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=%7b983E3A52-8374-410A-82BD-B8788733C70F%7d Double free vulnerability in libgnutls in GnuTLS before 3.0.14 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted certificate list. [gnutls-devel] 20120224 gnutls 3.0.14 24865 gnutls-libgnutls-certificate-dos(74099) Multiple cross-site scripting (XSS) vulnerabilities in the admin panel in osCMax before 2.5.1 allow remote attackers to inject arbitrary web script or HTML via the (1) username parameter in a process action to admin/login.php; (2) pageTitle, (3) current_product_id, or (4) cPath parameter to admin/new_attributes_include.php; (5) sb_id, (6) sb_key, (7) gc_id, (8) gc_key, or (9) path parameter to admin/htaccess.php; (10) title parameter to admin/information_form.php; (11) search parameter to admin/xsell.php; (12) gross or (13) max parameter to admin/stats_products_purchased.php; (14) status parameter to admin/stats_monthly_sales.php; (15) sorted parameter to admin/stats_customers.php; (16) information_id parameter to /admin/information_manager.php; or (17) zID parameter to /admin/geo_zones.php. 20120404 Multiple vulnerabilities in osCmax http://bugtrack.oscmax.com/view.php?id=1165 http://www.oscmax.com/blog/michael_s/oscmax_v251_has_been_released_security_update https://www.htbridge.com/advisory/HTB23081 Multiple SQL injection vulnerabilities in the admin panel in osCMax before 2.5.1 allow (1) remote attackers to execute arbitrary SQL commands via the username parameter in a process action to admin/login.php or (2) remote administrators to execute arbitrary SQL commands via the status parameter to admin/stats_monthly_sales.php or (3) country parameter in a process action to admin/create_account_process.php. 20120404 Multiple vulnerabilities in osCmax http://bugtrack.oscmax.com/view.php?id=1165 http://www.oscmax.com/blog/michael_s/oscmax_v251_has_been_released_security_update https://www.htbridge.com/advisory/HTB23081 Untrusted search path vulnerability in VMware Tools in VMware Workstation before 8.0.4, VMware Player before 4.0.4, VMware Fusion before 4.1.2, VMware View before 5.1, and VMware ESX 4.1 before U3 and 5.0 before P03 allows local users to gain privileges via a Trojan horse tpfc.dll file in the current working directory. Per: http://cwe.mitre.org/data/definitions/426.html 'CWE-426 Untrusted Search Path' 20120904 VMWare Tools susceptible to binary planting by hijack https://www.vmware.com/support/vsphere4/doc/vsp_esxi41_u3_rel_notes.html#resolvedissuessecurity ISC BIND 9.x before 9.7.6-P1, 9.8.x before 9.8.3-P1, 9.9.x before 9.9.1-P1, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P1 does not properly handle resource records with a zero-length RDATA section, which allows remote DNS servers to cause a denial of service (daemon crash or data corruption) or obtain sensitive information from process memory via a crafted record. APPLE-SA-2012-09-19-2 openSUSE-SU-2012:0722 SUSE-SU-2012:0741 SSRT100878 RHSA-2012:0717 RHSA-2012:1110 http://support.apple.com/kb/HT5501 DSA-2486 http://www.isc.org/software/bind/advisories/cve-2012-1667 VU#381699 MDVSA-2012:089 53772 SSA:2012-341-01 https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04952488 https://kb.isc.org/article/AA-00698 Directory traversal vulnerability in index.php in phpMoneyBooks before 1.0.3 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the module parameter. http://packetstormsecurity.com/files/111114/phpMoneyBooks-1.0.2-Local-File-Inclusion.html 20120322 'phpMoneyBooks' Local File Inclusion (CVE-2012-1669) http://sourceforge.net/projects/phpmoneybooks/files/Changelog.TXT/download 18648 20120322 'phpMoneyBooks' Local File Inclusion (CVE-2012-1669) 52532 admin/index.php in PHP Grade Book before 1.9.5 BETA allows remote attackers to read the database via a SaveSQL action. 20120322 'PHP Grade Book' Unauthenticated SQL Database Export (CVE-2012-1670) http://downloads.sourceforge.net/project/php-gradebook/phpGradeBook%20-%20BETA/1.9.5/phpGradeBook1.9.5.zip 80311 18647 52686 phpgradebook-info-disclosure(74292) Directory traversal vulnerability in index.php in phpPaleo 4.8b155 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter. 18701 [oss-security] 20120315 CVE Requests [oss-security] 20120315 Re: CVE Requests 52530 SQL injection vulnerability in getcity.php in Hotel Booking Portal 0.1 allows remote attackers to execute arbitrary SQL commands via the country parameter. 18702 52879 hotelbookingportal-getcity-sql-injection(74612) SQL injection vulnerability in loginscript.php in e-ticketing allows remote attackers to execute arbitrary SQL commands via the password parameter. 18700 52878 eticketing-loginscript-sql-injection(74613) Unspecified vulnerability in the Siebel Clinical component in Oracle Industry Applications 7.7, 7.8, 8.0.0.x, 8.1.1.x, and 8.2.2.x allows remote authenticated users to affect integrity via unknown vectors related to Web UI, a different vulnerability than CVE-2012-0582. 48885 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 1026952 The TNS Listener, as used in Oracle Database 11g 11.1.0.7, 11.2.0.2, and 11.2.0.3, and 10g 10.2.0.3, 10.2.0.4, and 10.2.0.5, as used in Oracle Fusion Middleware, Enterprise Manager, E-Business Suite, and possibly other products, allows remote attackers to execute arbitrary database commands by performing a remote registration of a database (1) instance or (2) service name that already exists, then conducting a man-in-the-middle (MITM) attack to hijack database connections, aka "TNS Poison." SUSE-SU-2012:0765 20120418 The history of a -probably- 13 years old Oracle bug: TNS Poison 20120428 Oracle TNS Poison vulnerability is actually a 0day with no patch available VU#359816 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/alert-cve-2012-1675-1608180.html 53308 1027000 https://blogs.oracle.com/security/entry/security_alert_for_cve_2012 oracledatabase-tnslistener-spoofing(75303) Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 5.0.2, 5.3.0 through 5.3.4, 6.0.1, and 6.2.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Virtual Banking. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 1026953 Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware allows remote attackers to affect integrity via unknown vectors. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the JD Edwards EnterpriseOne Tools component in Oracle JD Edwards Products 8.98, 9.1, and 24 allows remote authenticated users to affect confidentiality, related to Enterprise Infrastructure SEC. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 5.0.2, 5.3.0 through 5.3.4, 6.0.1, and 6.2.0 allows remote authenticated users to affect integrity via unknown vectors related to Core-Base. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 1026953 Unspecified vulnerability in the Siebel CRM component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Siebel Apps - Multi-channel Technologies. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in Oracle Sun Solaris 8, 9, 10, and 11 allows local users to affect availability via unknown vectors related to Kernel/sockfs. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 1026940 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans, a different vulnerability than CVE-2012-3136. NOTE: Oracle has not commented on claims from a downstream vendor that this issue is related to "XMLDecoder security issue via ClassFinder." SUSE-SU-2012:1148 openSUSE-SU-2012:1175 SUSE-SU-2012:1231 SSRT100970 RHSA-2012:1222 RHSA-2012:1225 RHSA-2012:1466 RHSA-2013:1455 RHSA-2013:1456 http://www.oracle.com/technetwork/topics/security/alert-cve-2012-4681-1835715.html USN-1553-1 Unspecified vulnerability in Oracle Sun Solaris 8, 9, 10, and 11 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to gssd. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 1026940 Unspecified vulnerability in Oracle Sun Solaris 8, 9, 10, and 11 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Password Policy. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 1026940 Unspecified vulnerability in the Secure Global Desktop component in Oracle Virtualization 4.6 allows remote attackers to affect integrity via unknown vectors related to Core. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html 1027666 secureglobaldesktop-core-cve20121685(79379) Unspecified vulnerability in the Oracle Business Intelligence Enterprise Edition component in Oracle Fusion Middleware 11.1.1.6 and other versions allows remote attackers to affect integrity via unknown vectors related to Installation. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html Unspecified vulnerability in Oracle Solaris 10 and 11 allows local users to affect integrity and availability, related to Logical Domains (LDOM). MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54508 1027274 solaris-logicaldomainsldom-cve20121687(77043) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.61 and earlier, and 5.5.21 and earlier, allows remote authenticated users to affect availability, related to Server DML. RHSA-2012:1462 GLSA-201308-06 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53067 1026934 Unspecified vulnerability in Oracle MySQL Server 5.1.62 and earlier, and 5.5.22 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer. RHSA-2012:1462 GLSA-201308-06 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54547 1027263 mysql-optimizer-dos(77065) Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.61 and earlier, and 5.5.21 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer, a different vulnerability than CVE-2012-1703. RHSA-2012:1462 GLSA-201308-06 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53074 1026934 Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Kernel/Privileges. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53137 1026940 Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect availability, related to SCTP. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53125 1026940 https://downloads.avaya.com/css/P8/documents/100161091 Unspecified vulnerability in Oracle SPARC Enterprise M Series Servers XCP 1110 allows remote attackers to affect availability, related to XSCF Control Package (XCP). MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53131 1026942 Unspecified vulnerability in Oracle Sun Solaris 10 allows remote attackers to affect confidentiality and integrity, related to libsasl. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 1026940 Unspecified vulnerability in the Oracle JRockit component in Oracle Fusion Middleware 28.2.2 and earlier, and JDK/JRE 5 and 6 27.7.1 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 1026948 Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.19 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer. GLSA-201308-06 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53071 1026934 Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.21 and earlier allows remote authenticated users to affect availability via unknown vectors related to Partition. GLSA-201308-06 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53064 1026934 Unspecified vulnerability in Oracle Sun Solaris 11 allows remote authenticated users to affect confidentiality, related to Kernel/GLD. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53128 1026940 The ProcSetEventMask function in difs/events.c in the xfs font server for X.Org X11R6 through X11R6.6 and XFree86 before 3.3.3 calls the SendErrToClient function with a mask value instead of a pointer, which allows local users to cause a denial of service (memory corruption and crash) or obtain potentially sensitive information from memory via a SetEventMask request that triggers an invalid pointer dereference. http://invisible-island.net/ansification/ansify-xfs-cve.html [xorg-announce] 20120724 X.Org security advisory: DoS/info leak in xfs prior to X11R6.7/XFree86 3.3.3 SSRT100883 http://twitter.com/bsdaemon/status/228958599790071809 https://blogs.oracle.com/sunsecurity/entry/cve_2012_1699_denial_of https://bugzilla.redhat.com/show_bug.cgi?id=842841 oval:org.mitre.oval:def:19369 Unspecified vulnerability in the Siebel CRM component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Siebel UI Framework. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Siebel CRM component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Highly Interactive Web UI. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier and 5.5.28 and earlier allows remote attackers to affect availability via unknown vectors. RHSA-2013:0219 GLSA-201308-06 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html USN-1703-1 oval:org.mitre.oval:def:17186 Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.61 and earlier, and 5.5.21 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer, a different vulnerability than CVE-2012-1690. RHSA-2012:1462 GLSA-201308-06 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53058 1026934 Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 5.0.2, 5.3.0 through 5.3.4, 6.0.1, and 6.2.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Core-Base, a different vulnerability than CVE-2012-1707. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53094 1026953 Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier and 5.5.28 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer. RHSA-2013:0219 GLSA-201308-06 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html USN-1703-1 oval:org.mitre.oval:def:17268 Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 5.0.2, 5.3.0 through 5.3.4, 6.0.1, and 6.2.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Logging. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53116 1026953 Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 5.0.2, 5.3.0 through 5.3.4, 6.0.1, and 6.2.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Core-Base, a different vulnerability than CVE-2012-1704. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53107 1026953 Unspecified vulnerability in the Application Express component in Oracle Database Server 4.0 and 4.1 allows remote attackers to affect integrity via unknown vectors. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 53104 1026929 Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Designer, a different vulnerability than CVE-2012-1710. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 1026949 Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Designer, a different vulnerability than CVE-2012-1709. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuapr2012-366314.html 1026949 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to CORBA. [OpenJDK] 20120612 IcedTea6 1.10.8 & 1.11.3 Released SSRT100919 RHSA-2012:0734 GLSA-201406-32 MDVSA-2012:095 http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html 53949 oval:org.mitre.oval:def:15996 Directory traversal vulnerability in the Liferay component in Oracle Sun GlassFish Web Space Server before 10.0 Update 7 Patch 2 has unknown impact and attack vectors. https://blogs.oracle.com/sunsecurity/entry/cve_2012_1712_path_traversal Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, 1.4.2_37 and earlier, and JavaFX 2.1 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. SUSE-SU-2012:1177 SUSE-SU-2012:1204 SUSE-SU-2012:1231 SUSE-SU-2012:1265 [OpenJDK] 20120612 IcedTea6 1.10.8 & 1.11.3 Released SSRT100919 RHSA-2012:0734 RHSA-2012:1243 RHSA-2013:1455 RHSA-2013:1456 GLSA-201406-32 http://www.ibm.com/support/docview.wss?uid=swg21615246 MDVSA-2012:095 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html 53946 oval:org.mitre.oval:def:16502 Unspecified vulnerability in a TList 6 ActiveX control in Oracle Hyperion Financial Management 11.1.1.4 and 11.1.2.1.104 allows remote attackers to execute arbitrary code via unknown vectors. https://blogs.oracle.com/sunsecurity/entry/cve_2012_1714_tlist_6 Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote attackers to affect integrity, related to HTML Pages. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54558 1027269 ebusinesssuite-aolhtml-cve20121715(77015) Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, and 5 update 35 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Swing. SUSE-SU-2012:1204 SUSE-SU-2012:1231 SUSE-SU-2012:1265 [OpenJDK] 20120612 IcedTea6 1.10.8 & 1.11.3 Released SSRT100919 RHSA-2012:0734 RHSA-2013:1455 RHSA-2013:1456 GLSA-201406-32 http://www.ibm.com/support/docview.wss?uid=swg21615246 MDVSA-2012:095 http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html 53947 oval:org.mitre.oval:def:16168 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows local users to affect confidentiality via unknown vectors related to printing on Solaris or Linux. Per: http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html 'Applies to printing on the Solaris and Linux platforms. This vulnerability cannot be exploited through untrusted Java Web Start applications or untrusted Java applets. It also cannot be exploited by supplying data to APIs in the specified Component without using untrusted Java Web Start applications or untrusted Java applets, such as through a web service.' SUSE-SU-2012:1177 SUSE-SU-2012:1204 SUSE-SU-2012:1231 SUSE-SU-2012:1265 [OpenJDK] 20120612 IcedTea6 1.10.8 & 1.11.3 Released RHSA-2012:0734 RHSA-2012:1243 RHSA-2013:1455 RHSA-2013:1456 GLSA-201406-32 http://www.ibm.com/support/docview.wss?uid=swg21615246 MDVSA-2012:095 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html 53952 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect availability via unknown vectors related to Security. SUSE-SU-2012:1177 SUSE-SU-2012:1204 SUSE-SU-2012:1231 SUSE-SU-2012:1265 [OpenJDK] 20120612 IcedTea6 1.10.8 & 1.11.3 Released SSRT100919 RHSA-2012:0734 RHSA-2012:1243 RHSA-2012:1467 RHSA-2013:1455 RHSA-2013:1456 GLSA-201406-32 http://www.ibm.com/support/docview.wss?uid=swg21615246 MDVSA-2012:095 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html 53951 http://www-01.ibm.com/support/docview.wss?uid=swg21620575 oval:org.mitre.oval:def:15923 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect integrity, related to CORBA. SUSE-SU-2012:1177 SUSE-SU-2012:1204 SUSE-SU-2012:1231 SUSE-SU-2012:1265 [OpenJDK] 20120612 IcedTea6 1.10.8 & 1.11.3 Released SSRT100919 RHSA-2012:0734 RHSA-2012:1243 RHSA-2013:1455 RHSA-2013:1456 GLSA-201406-32 http://www.ibm.com/support/docview.wss?uid=swg21615246 MDVSA-2012:095 http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html 53950 oval:org.mitre.oval:def:16312 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier, when running on Solaris, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Networking. SSRT100919 http://www.ibm.com/support/docview.wss?uid=swg21615246 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html 53956 oval:org.mitre.oval:def:16581 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, and 6 update 32 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2012-1722. SUSE-SU-2012:1231 SUSE-SU-2012:1265 SSRT100919 RHSA-2012:0734 RHSA-2013:1455 RHSA-2013:1456 http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html 53959 oval:org.mitre.oval:def:16358 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, and 6 update 32 and earlier, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2012-1721. SUSE-SU-2012:1231 SUSE-SU-2012:1265 SSRT100919 RHSA-2012:0734 RHSA-2013:1455 RHSA-2013:1456 http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html 53953 oval:org.mitre.oval:def:16214 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. [OpenJDK] 20120612 IcedTea6 1.10.8 & 1.11.3 Released SSRT100919 RHSA-2012:0734 GLSA-201406-32 http://www.ibm.com/support/docview.wss?uid=swg21615246 MDVSA-2012:095 http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html 53960 oval:org.mitre.oval:def:16259 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, and 6 update 32 and earlier, allows remote attackers to affect availability, related to JAXP. [OpenJDK] 20120612 IcedTea6 1.10.8 & 1.11.3 Released SSRT100919 RHSA-2012:0734 GLSA-201406-32 MDVSA-2012:095 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html 53958 oval:org.mitre.oval:def:16659 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, and 5 update 35 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Hotspot. SUSE-SU-2012:1204 SUSE-SU-2012:1231 SUSE-SU-2012:1265 [OpenJDK] 20120612 IcedTea6 1.10.8 & 1.11.3 Released SSRT100919 RHSA-2012:0734 RHSA-2013:1455 RHSA-2013:1456 GLSA-201406-32 http://www.ibm.com/support/docview.wss?uid=swg21615246 MDVSA-2012:095 http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html 53954 oval:org.mitre.oval:def:16513 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier allows remote attackers to affect confidentiality and integrity via unknown vectors related to Libraries. SUSE-SU-2012:1231 SSRT100919 GLSA-201406-32 http://www.oracle.com/technetwork/topics/security/javacpujun2012-1515912.html 53948 oval:org.mitre.oval:def:16699 Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.4, 12.0.6, 12.1.1, 12.1.2, and 12.1.3 allows remote authenticated users to affect integrity via unknown vectors related to Document Repository. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54565 1027269 ebusinesssuite-aoldr-cve20121727(77017) Unspecified vulnerability in the Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Portal Framework. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54519 1027267 siebelcrm-portalframework-cve20121728(77034) Unspecified vulnerability in the Hyperion BI+ component in Oracle Hyperion 11.1.1.3 and earlier allows remote attackers to affect integrity via unknown vectors related to UI and Visualization. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54509 1027273 hyperionbi-uiandvisualization-cve20121729(77013) Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Password Management. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54561 1027269 ebusinesssuite-aolpm-cve20121730(77016) Unspecified vulnerability in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Web UI. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54512 1027267 siebelcrm-webui-cve20121731(77033) Unspecified vulnerability in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to UI Framework, a different vulnerability than CVE-2012-1754. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54538 1027267 siebelcrm-uiframework-info-disc(77038) Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.50, 8.51, and 8.52 allows remote authenticated users to affect confidentiality via unknown vectors related to CM. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54539 1027265 peoplesoftenterprise-ptcm-info-disc(77029) Unspecified vulnerability in Oracle MySQL Server 5.1.62 and earlier, and 5.5.23 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer. RHSA-2012:1462 GLSA-201308-06 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54540 1027263 mysql-servopt-dos(77064) Unspecified vulnerability in Oracle MySQL Server 5.5.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54549 1027263 mysql-serveroptimizer-dos(77060) Unspecified vulnerability in the Oracle MapViewer component in Oracle Fusion Middleware 10.1.3.1 allows remote attackers to affect confidentiality via unknown vectors related to Oracle Maps. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54514 1027264 fusionmiddleware-mapviewermaps-info-disc(76995) Unspecified vulnerability in the Enterprise Manager for Oracle Database component in Oracle Database Server 11.1.0.7, 11.2.0.2, and 11.2.0.3, and Enterprise Manager Grid Control EM Base Platform 10.2.0.5, EM Base Platform 11.1.0.1, EM Plugin for DB 12.1.0.1, and EM Plugin for DB 12.1.0.2, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to DB Performance Advisories/UIs. SUSE-SU-2012:1020 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54569 1027260 emgcl-dbp-cve20121737(77014) Unspecified vulnerability in the Oracle iPlanet Web Server component in Oracle Sun Products Suite Java System Web Server 6.1 and Oracle iPlanet Web Server 7.0 allows remote attackers to affect availability via unknown vectors related to Web Server. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54515 1027276 iplanetwebserver-webserver-dos(77058) Unspecified vulnerability in the Oracle E-Business Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.0.4, 12.0.6, 12.1.1, 12.1.2, and 12.1.3 allows remote authenticated users to affect integrity via unknown vectors related to Financials Business Intelligence. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54566 1027269 ebusinesssuite-fbi-cve20121739(77018) Unspecified vulnerability in the Oracle Application Express Listener component in Oracle Application Express Listener 1.1-ea, 1.1.1, 1.1.2, and 1.1.3 allows remote attackers to affect confidentiality via unknown vectors. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54498 1027270 Unspecified vulnerability in the Enterprise Manager for Fusion Middleware component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality and integrity via unknown vectors related to User Administration Pages. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54492 1027264 fusionmiddleware-emuap-cve20121741(76994) Unspecified vulnerability in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect availability via unknown vectors related to UI Framework, a different vulnerability than CVE-2012-1760. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54521 1027267 siebelcrm-uiframework-dos(77035) Unspecified vulnerability in the Oracle Clinical Remote Data Capture Option component in Oracle Industry Applications 4.6.0.x, 4.6.2, and 4.6.3 allows remote authenticated users to affect confidentiality, related to HTML Surround. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54563 1027266 clinicalremote-html-info-disc(77040) Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.5 and 8.3.7 allows context-dependent users to affect availability via unknown vectors related to Outside In Filters. Per: http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 'Outside In Technology is a suite of software development kits (SDKs). It does not have any particular associated protocol. If the hosting software passes data received over the network to Outside In Technology code, the CVSS score would increase to 6.8.' MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54552 1027264 http://www-01.ibm.com/support/docview.wss?uid=swg21660640 outsideintechnology-infil-dos(77012) Unspecified vulnerability in the Network Layer component in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to affect availability via unknown vectors. SUSE-SU-2012:1020 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54501 1027260 Unspecified vulnerability in the Network Layer component in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3, when running on Windows, allows remote attackers to affect availability via unknown vectors, a different vulnerability than CVE-2012-1747. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54507 1027260 Unspecified vulnerability in the Network Layer component in Oracle Database Server 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3, when running on Windows, allows remote attackers to affect availability via unknown vectors, a different vulnerability than CVE-2012-1746. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54518 1027260 Unspecified vulnerability in the PeopleSoft Enterprise HRMS component in Oracle PeopleSoft Products 9.1 allows remote authenticated users to affect confidentiality via unknown vectors related to Candidate Gateway, a different vulnerability than CVE-2012-0562. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54527 1027265 peoplesoftenterprise-hrmscg-info-disc(77027) Unspecified vulnerability in the Oracle MapViewer component in Oracle Fusion Middleware 10.1.3.1 and 11.1.1.5 allows remote attackers to affect confidentiality via unknown vectors related to Oracle Maps. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54516 1027264 fusionmiddleware-mvm-info-disc(76996) Unspecified vulnerability in Oracle Sun Solaris 8, 9, 10, and 11 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to mailx. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 1027274 solaris-mailx1-cve20121750(77051) Unspecified vulnerability in the Core RDBMS component in Oracle Database Server 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to flashback archive. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect availability, related to Kernel/NFS. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54530 1027274 solaris-kernelnfs-dos(77049) Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.50, 8.51, and 8.52 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to PC. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54544 1027265 peoplesoftenterprise-ptpc-cve20121753(77025) Unspecified vulnerability in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to UI Framework, a different vulnerability than CVE-2012-1732. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54542 1027267 siebelcrm-uiframe-info-disc(77039) Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Products 8.51 allows remote attackers to affect integrity via vectors related to PeopleBooks - PSOL. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html Unspecified vulnerability in Oracle MySQL Server 5.5.23 and earlier allows remote authenticated users to affect availability via unknown vectors. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54524 1027263 mysql-server1-dos(77063) Unspecified vulnerability in Oracle MySQL Server 5.5.23 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54526 1027263 mysql-innodb1-dos(77062) Unspecified vulnerability in the Oracle AutoVue component in Oracle Supply Chain Products Suite 20.0.2 and 20.1 allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-1759. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54571 1027268 supplychain-autovue-dos(77020) Unspecified vulnerability in the Oracle AutoVue component in Oracle Supply Chain Products Suite 20.0.2 and 20.1 allows remote authenticated users to affect availability via unknown vectors, a different vulnerability than CVE-2012-1758. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54555 1027268 supplychain-auto-dos(77021) Unspecified vulnerability in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect availability via unknown vectors related to UI Framework, a different vulnerability than CVE-2012-1742. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54529 1027267 siebelcrm-uiframe-dos(77036) Unspecified vulnerability in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via unknown vectors related to UI Framework. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54533 1027267 siebelcrm-uiframework-cve20121761(77037) Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.50, 8.51, and 8.52 allows remote authenticated users to affect integrity, related to TECH, a different vulnerability than CVE-2012-3111. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54499 1027265 peoplesoftenterprise-pttech-cve20121762(77031) Unspecified vulnerability in the Oracle Clinical/Remote Data Capture component in Oracle Industry Applications 4.6.0 and 4.6.2 allows remote authenticated users to affect confidentiality, related to HTML Surround. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html 1027675 Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.50, 8.51, and 8.52 allows remote authenticated users to affect integrity, related to MCF. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54545 1027265 peoplesoftenterprise-ptmcf-cve20121764(77030) Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect integrity via unknown vectors related to Branded Zone. MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54532 1027274 solaris-brandedzone-cve20121765(77050) Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.5 and 8.3.7 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2012-1767, CVE-2012-1769, CVE-2012-1770, CVE-2012-1771, CVE-2012-1772, CVE-2012-1773, CVE-2012-3106, CVE-2012-3107, CVE-2012-3108, and CVE-2012-3110. Per: http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 'Outside In Technology is a suite of software development kits (SDKs). It does not have any particular associated protocol. If the hosting software passes data received over the network to Outside In Technology code, the CVSS score would increase to 6.8.' http://blogs.technet.com/b/srd/archive/2012/07/24/more-information-on-security-advisory-2737111.aspx http://technet.microsoft.com/security/advisory/2737111 VU#118913 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54531 1027264 http://www-01.ibm.com/support/docview.wss?uid=swg21660640 MS12-058 MS12-067 outsideintechnology-outsideinfilters-dos(76999) oval:org.mitre.oval:def:15724 Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.5 and 8.3.7 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2012-1766, CVE-2012-1769, CVE-2012-1770, CVE-2012-1771, CVE-2012-1772, CVE-2012-1773, CVE-2012-3106, CVE-2012-3107, CVE-2012-3108, and CVE-2012-3110. Per: http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 'Outside In Technology is a suite of software development kits (SDKs). It does not have any particular associated protocol. If the hosting software passes data received over the network to Outside In Technology code, the CVSS score would increase to 6.8.' http://blogs.technet.com/b/srd/archive/2012/07/24/more-information-on-security-advisory-2737111.aspx http://technet.microsoft.com/security/advisory/2737111 VU#118913 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54536 1027264 http://www-01.ibm.com/support/docview.wss?uid=swg21660640 MS12-058 MS12-067 outsideintechnology-oif-dos(77000) oval:org.mitre.oval:def:15812 Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.7 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2012-3109. Per: http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 'Outside In Technology is a suite of software development kits (SDKs). It does not have any particular associated protocol. If the hosting software passes data received over the network to Outside In Technology code, the CVSS score would increase to 6.8.' http://blogs.technet.com/b/srd/archive/2012/07/24/more-information-on-security-advisory-2737111.aspx http://technet.microsoft.com/security/advisory/2737111 VU#118913 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54511 1027264 http://www-01.ibm.com/support/docview.wss?uid=swg21660640 MS12-058 MS12-067 outsideintechnology-outfil-dos(77001) oval:org.mitre.oval:def:15275 Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.5 and 8.3.7 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2012-1766, CVE-2012-1767, CVE-2012-1770, CVE-2012-1771, CVE-2012-1772, CVE-2012-1773, CVE-2012-3106, CVE-2012-3107, CVE-2012-3108, and CVE-2012-3110. Per: http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 'Outside In Technology is a suite of software development kits (SDKs). It does not have any particular associated protocol. If the hosting software passes data received over the network to Outside In Technology code, the CVSS score would increase to 6.8.' http://blogs.technet.com/b/srd/archive/2012/07/24/more-information-on-security-advisory-2737111.aspx http://technet.microsoft.com/security/advisory/2737111 VU#118913 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54500 1027264 http://www-01.ibm.com/support/docview.wss?uid=swg21660640 MS12-058 MS12-067 outsideintechnology-ofilter-dos(77002) oval:org.mitre.oval:def:15721 Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.5 and 8.3.7 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2012-1766, CVE-2012-1767, CVE-2012-1769, CVE-2012-1771, CVE-2012-1772, CVE-2012-1773, CVE-2012-3106, CVE-2012-3107, CVE-2012-3108, and CVE-2012-3110. Per: http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 'Outside In Technology is a suite of software development kits (SDKs). It does not have any particular associated protocol. If the hosting software passes data received over the network to Outside In Technology code, the CVSS score would increase to 6.8.' http://blogs.technet.com/b/srd/archive/2012/07/24/more-information-on-security-advisory-2737111.aspx http://technet.microsoft.com/security/advisory/2737111 VU#118913 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54541 1027264 http://www-01.ibm.com/support/docview.wss?uid=swg21660640 MS12-058 MS12-067 outsideintechnology-outside-dos(77003) oval:org.mitre.oval:def:14882 Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.5 and 8.3.7 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2012-1766, CVE-2012-1767, CVE-2012-1769, CVE-2012-1770, CVE-2012-1772, CVE-2012-1773, CVE-2012-3106, CVE-2012-3107, CVE-2012-3108, and CVE-2012-3110. Per: http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 'Outside In Technology is a suite of software development kits (SDKs). It does not have any particular associated protocol. If the hosting software passes data received over the network to Outside In Technology code, the CVSS score would increase to 6.8.' http://blogs.technet.com/b/srd/archive/2012/07/24/more-information-on-security-advisory-2737111.aspx http://technet.microsoft.com/security/advisory/2737111 VU#118913 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54543 1027264 http://www-01.ibm.com/support/docview.wss?uid=swg21660640 MS12-058 MS12-067 outsideintechnology-out-dos(77004) oval:org.mitre.oval:def:15668 Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.5 and 8.3.7 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2012-1766, CVE-2012-1767, CVE-2012-1769, CVE-2012-1770, CVE-2012-1771, CVE-2012-1773, CVE-2012-3106, CVE-2012-3107, CVE-2012-3108, and CVE-2012-3110. Per: http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 'Outside In Technology is a suite of software development kits (SDKs). It does not have any particular associated protocol. If the hosting software passes data received over the network to Outside In Technology code, the CVSS score would increase to 6.8.' http://blogs.technet.com/b/srd/archive/2012/07/24/more-information-on-security-advisory-2737111.aspx http://technet.microsoft.com/security/advisory/2737111 VU#118913 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54497 1027264 http://www-01.ibm.com/support/docview.wss?uid=swg21660640 MS12-058 MS12-067 outsideintechnology-outin-dos(77005) oval:org.mitre.oval:def:15323 Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.5 and 8.3.7 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2012-1766, CVE-2012-1767, CVE-2012-1769, CVE-2012-1770, CVE-2012-1771, CVE-2012-1772, CVE-2012-3106, CVE-2012-3107, CVE-2012-3108, and CVE-2012-3110. Per: http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 'Outside In Technology is a suite of software development kits (SDKs). It does not have any particular associated protocol. If the hosting software passes data received over the network to Outside In Technology code, the CVSS score would increase to 6.8.' http://blogs.technet.com/b/srd/archive/2012/07/24/more-information-on-security-advisory-2737111.aspx http://technet.microsoft.com/security/advisory/2737111 VU#118913 MDVSA-2013:150 http://www.oracle.com/technetwork/topics/security/cpujul2012-392727.html 54548 1027264 http://www-01.ibm.com/support/docview.wss?uid=swg21660640 MS12-058 MS12-067 outsideintechnology-outinfilt-dos(77006) oval:org.mitre.oval:def:15568 Unspecified vulnerability in the Open URL feature in Gretech GOM Media Player before 2.1.39.5101 has unknown impact and attack vectors, a different vulnerability than CVE-2007-5779 and CVE-2012-1264. 80203 http://player.gomlab.com/eng/download/ gommediaplayer-openurl-unspecified(74120) Stack-based buffer overflow in VideoLAN VLC media player before 2.0.1 allows remote attackers to execute arbitrary code via a crafted MMS:// stream. http://git.videolan.org/?p=vlc/vlc-2.0.git;a=commit;h=11a95cce96fffdbaba1be6034d7b42721667821c 18825 52550 53391 http://www.videolan.org/security/sa1201.html oval:org.mitre.oval:def:14820 Multiple heap-based buffer overflows in VideoLAN VLC media player before 2.0.1 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Real RTSP stream. 52550 http://www.videolan.org/security/sa1202.html vlcmediaplayer-realrtsp-bo(74118) oval:org.mitre.oval:def:14817 SQL injection vulnerability in my.activation.php3 in F5 FirePass 6.0.0 through 6.1.0 and 7.0.0 allows remote attackers to execute arbitrary SQL commands via the state parameter. http://packetstormsecurity.org/files/111276/F5-FirePass-SSL-VPN-6.x-7.x-SQL-Injection.html 20120328 SEC Consult SA-20120328-0 :: F5 FirePass SSL VPN unauthenticated remote root through SQL injection - CVE-2012-1777 http://support.f5.com/kb/en-us/solutions/public/13000/400/sol13463.html 1026834 firepass-unspecified-sql-injection(74198) firepass-state-sql-injection(74450) https://www.sec-consult.com/files/20120328-0_F5_FirePass_SSL_VPN_unauthenticated_remote_root_v1.0.txt SQL injection vulnerability in artykul_print.php in CreateVision CMS allows remote attackers to execute arbitrary SQL commands via the id parameter. 18525 createvision-artykulprint-sql-injection(73483) Cross-site scripting (XSS) vulnerability in IDevSpot idev-BusinessDirectory 3.0 allows remote attackers to inject arbitrary web script or HTML via the SEARCH parameter to index.php. 79636 http://packetstormsecurity.org/files/110212/idev-BusinessDirectory-3.0-Cross-Site-Scripting.html 52171 idevbusinessdirectory-index-xss(73505) SQL injection vulnerability in search.php in SocialCMS 1.0.5 allows remote attackers to execute arbitrary SQL commands via the category parameter. http://packetstormsecurity.org/files/110043/SocialCMS-Cross-Site-Scripting-SQL-Injection.html 52109 socialcms-commentajax-sql-injection(73440) Multiple cross-site scripting (XSS) vulnerabilities in ajax/commentajax.php in SocialCMS 1.0.5 allow remote attackers to inject arbitrary web script or HTML via the (1) TREF_email_address or (2) TR_name parameters. http://packetstormsecurity.org/files/110043/SocialCMS-Cross-Site-Scripting-SQL-Injection.html 52109 socialcms-search-xss(73442) Multiple cross-site scripting (XSS) vulnerabilities in questions/ask in OSQA 3b allow remote attackers to inject arbitrary web script or HTML via the (1) url bar or (2) picture bar. 20120227 OSQA CMS v3b - Multiple Persistent Vulnerabilities 52184 http://www.vulnerability-lab.com/get_content.php?id=461 Tiny Server 1.1.9 and earlier allows remote attackers to cause a denial of service (crash) via a long string in a GET request without an HTTP version number. 18524 tiny-http-dos(73482) SQL injection vulnerability in MyJobList 0.1.3 allows remote attackers to execute arbitrary SQL commands via the eid parameter in a profile action to index.php. 79637 http://packetstormsecurity.org/files/110225/MyJobList-0.1.3-SQL-Injection.html 52168 myjoblist-index-sql-injection(73503) kg_callffmpeg.php in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to execute arbitrary commands via unspecified vectors. http://plugins.trac.wordpress.org/changeset?old_path=%2Fvideo-embed-thumbnail-generator&old=507924&new_path=%2Fvideo-embed-thumbnail-generator&new=507924 http://wordpress.org/extend/plugins/video-embed-thumbnail-generator/changelog/ 52180 videoembed-kgcallffmpeg-code-execution(73508) The Media Upload form in the Video Embed & Thumbnail Generator plugin before 2.0 for WordPress allows remote attackers to obtain the installation path via unknown vectors. http://plugins.trac.wordpress.org/changeset?old_path=%2Fvideo-embed-thumbnail-generator&old=507924&new_path=%2Fvideo-embed-thumbnail-generator&new=507924 http://wordpress.org/extend/plugins/video-embed-thumbnail-generator/changelog/ 52652 Multiple cross-site scripting (XSS) vulnerabilities in wgarcmin.cgi in Webglimpse 2.20.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) URL, (2) FILE, or (3) DOMAIN parameters. 79648 http://packetstormsecurity.org/files/110219/Webglimpse-Brute-Force-Cross-Site-Scripting.html http://websecurity.com.ua/3089/ 52170 webglimpse-wgarcmin-xss(73485) Multiple cross-site scripting (XSS) vulnerabilities in wonderdesk.cgi in WonderDesk SQL 4.14 allow remote attackers to inject arbitrary web script or HTML via the (1) cus_email parameter in a cust_lostpw action; or (2) help_name, (3) help_email, (4) help_website, or (5) help_example_url parameters in an hd_modify_record action. 79647 http://packetstormsecurity.org/files/110224/WonderDesk-Cross-Site-Scripting.html http://st2tea.blogspot.com/2012/02/wonderdesk-cross-site-scripting.html 52193 wonderdesk-wonderdesk-xss(73502) Multiple cross-site scripting (XSS) vulnerabilities in Kongreg8 1.7.3 allow remote attackers to inject arbitrary web script or HTML via the (1) surname or (2) firstname parameters to modules/members/addmember.php; or (3) groupdescription or (4) groupname parameters to modules/groups/addgroupform.php. 20120224 Kongreg8 1.7.3 Mutiple XSS 52178 kongreg8-multiple-xss(73510) Absolute path traversal vulnerability in Webgrind 1.0 and 1.0.2 allows remote attackers to read arbitrary files via a full pathname in the file parameter to index.php. http://code.google.com/p/webgrind/issues/detail?id=66 http://packetstormsecurity.org/files/110216 18523 http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5075.php webgrind-index-file-include(73509) Cross-site scripting (XSS) vulnerability in osCommerce/OM/Core/Site/Setup/Application/Install/RPC/DBCheck.php in OSCommerce Online Merchant 3.0.2, when the software is being installed, allows remote attackers to inject arbitrary web script or HTML via the name parameter to oscommerce/index.php, which is not properly handled in an error message. NOTE: this might not be a vulnerability, since the ability to access oscommerce/index.php during installation may already imply administrator privileges. https://www.trustwave.com/spiderlabs/advisories/TWSL2012-005.txt webglimpse.cgi in Webglimpse before 2.20.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the query parameter, as exploited in the wild in March 2012. 80344 48452 VU#364363 1026825 Unspecified vulnerability in IBM Tivoli Monitoring Agent (ITMA), as used in IBM DB2 9.5 before FP9 on UNIX, allows local users to gain privileges via unknown vectors. IC79970 http://www-01.ibm.com/support/docview.wss?uid=swg21586193 db2-itma-priv-esc(74325) oval:org.mitre.oval:def:14526 IBM DB2 9.5 uses world-writable permissions for nodes.reg, which has unspecified impact and attack vectors. http://www-01.ibm.com/support/docview.wss?crawler=1&uid=swg1IC79518 IC79518 db2-nodes-unspecified(74326) oval:org.mitre.oval:def:14922 The TIFFGetEXIFProperties function in coders/tiff.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted EXIF IFD in a TIFF image. openSUSE-SU-2012:0692 RHSA-2012:0544 DSA-2462 http://www.imagemagick.org/discourse-server/viewtopic.php?f=4&t=20629 52898 1027032 imagemagick-tiffexififd-dos(74659) The web server on the Siemens Scalance S Security Module firewall S602 V2, S612 V2, and S613 V2 with firmware before 2.3.0.3 does not limit the rate of authentication attempts, which makes it easier for remote attackers to obtain access via a brute-force attack on the administrative password. http://support.automation.siemens.com/WW/view/en/59869684 http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-268149.pdf http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-05.pdf Stack-based buffer overflow in the Profinet DCP protocol implementation on the Siemens Scalance S Security Module firewall S602 V2, S612 V2, and S613 V2 with firmware before 2.3.0.3 allows remote attackers to cause a denial of service (device outage) or possibly execute arbitrary code via a crafted DCP frame. http://support.automation.siemens.com/WW/view/en/59869684 http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-268149.pdf http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-05.pdf Multiple stack-based buffer overflows in (1) COM and (2) ActiveX controls in ABB WebWare Server, WebWare SDK, Interlink Module, S4 OPC Server, QuickTeach, RobotStudio S4, and RobotStudio Lite allow remote attackers to execute arbitrary code via crafted input data. 52888 http://www.us-cert.gov/control_systems/pdf/ICSA-12-095-01A.pdf http://www05.abb.com/global/scot/scot348.nsf/veritydisplay/35df9dc4a94ae83ac12579ca0043acc1/$file/SI10231A2%20rev%200.pdf Buffer overflow in the embedded web server on the Siemens Scalance X Industrial Ethernet switch X414-3E before 3.7.1, X308-2M before 3.7.2, X-300EEC before 3.7.2, XR-300 before 3.7.2, and X-300 before 3.7.2 allows remote attackers to cause a denial of service (device reboot) or possibly execute arbitrary code via a malformed URL. http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-130874.pdf http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-04.pdf RuggedCom Rugged Operating System (ROS) 3.10.x and earlier has a factory account with a password derived from the MAC Address field in the banner, which makes it easier for remote attackers to obtain access by performing a calculation on this address value, and then establishing a (1) TELNET, (2) remote shell (aka rsh), or (3) serial-console session. 20120423 RuggedCom - Backdoor Accounts in my SCADA network? You don't say... http://arstechnica.com/business/news/2012/04/backdoor-in-mission-critical-hardware-threatens-power-traffic-control-systems.ars http://ics-cert.us-cert.gov/advisories/ICSA-12-146-01A 20120423 RuggedCom - Backdoor Accounts in my SCADA network? You don't say... 18779 VU#889195 http://www.kb.cert.org/vuls/id/MAPG-8RCPEN http://www.ruggedcom.com/productbulletin/ros-security-page/ 53215 http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-12-116-01A.pdf http://www.wired.com/threatlevel/2012/04/ruggedcom-backdoor/ ruggedcom-operating-system-backdoor(75120) The OPC server in Progea Movicon before 11.3 allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) via a crafted HTTP request. 53484 http://www.us-cert.gov/control_systems/pdf/ICSA-12-131-01.pdf Buffer overflow in the ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 allows remote attackers to execute arbitrary code via long strings in unspecified parameters. http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-02.pdf koyo-ecom-bo(74875) The ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 supports a maximum password length of 8 bytes, which makes it easier for remote attackers to obtain access via a brute-force attack. http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-02.pdf koyo-ecom-unauth-access(74876) Cross-site scripting (XSS) vulnerability in the web server in the ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-02.pdf The web server in the ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 does not require authentication, which allows remote attackers to perform unspecified functions via unknown vectors. http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-02.pdf koyo-ecom-unspecified(74878) The web server in the ECOM Ethernet module in Koyo H0-ECOM, H0-ECOM100, H2-ECOM, H2-ECOM-F, H2-ECOM100, H4-ECOM, H4-ECOM-F, and H4-ECOM100 allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors. http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-02.pdf EOSCoreScada.exe in C3-ilex EOScada before 11.0.19.2 allows remote attackers to cause a denial of service (daemon restart) by sending data to TCP port (1) 5050 or (2) 24004. 56364 http://www.us-cert.gov/control_systems/pdf/ICSA-12-271-01.pdf eoscada-eoscorescada-dos(79753) EOSDataServer.exe in C3-ilex EOScada before 11.0.19.2 allows remote attackers to cause a denial of service by sending a large amount of data to TCP port 24006. 56364 http://www.us-cert.gov/control_systems/pdf/ICSA-12-271-01.pdf eoscada-eosdataserver-dos(79754) eosfailoverservice.exe in C3-ilex EOScada before 11.0.19.2 allows remote attackers to obtain sensitive cleartext information via a session on TCP port 12000. 56364 http://www.us-cert.gov/control_systems/pdf/ICSA-12-271-01.pdf eoscada-eosfailoverservive-info-disc(79756) eosfailoverservice.exe in C3-ilex EOScada before 11.0.19.2 allows remote attackers to cause a denial of service by sending a large amount of data to TCP port 12000. 56364 http://www.us-cert.gov/control_systems/pdf/ICSA-12-271-01.pdf eoscada-eosfailoverservice-dos(79755) Cross-site scripting (XSS) vulnerability in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. 53591 http://www.us-cert.gov/control_systems/pdf/ICSA-12-138-01.pdf SQL injection vulnerability in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. 53591 http://www.us-cert.gov/control_systems/pdf/ICSA-12-138-01.pdf PORTSERV.exe in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to cause a denial of service (daemon crash) via a crafted (1) TCP or (2) UDP packet to port 111. 53591 http://www.us-cert.gov/control_systems/pdf/ICSA-12-138-01.pdf Buffer overflow in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows user-assisted remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via an invalid field in a project file. 53591 http://www.us-cert.gov/control_systems/pdf/ICSA-12-138-01.pdf An unspecified ActiveX control in Emerson DeltaV and DeltaV Workstations 9.3.1, 10.3.1, 11.3, and 11.3.1 and DeltaV ProEssentials Scientific Graph 5.0.0.6 allows remote attackers to overwrite arbitrary files via unknown vectors. 53591 http://www.us-cert.gov/control_systems/pdf/ICSA-12-138-01.pdf Untrusted search path vulnerability in WellinTech KingView 6.53 allows local users to gain privileges via a Trojan horse DLL in the current working directory. Per: http://cwe.mitre.org/data/lists/426.html 'Untrusted Search Path' Per: http://www.us-cert.gov/control_systems/pdf/ICSA-12-122-01.pdf 'This vulnerability is remotely exploitable but may require the use of social engineering to exploit.' http://en.wellintech.com/news/detail.aspx?contentid=168 53316 http://www.us-cert.gov/control_systems/pdf/ICSA-12-122-01.pdf kingview-dll-code-execution(75309) The bgp_capability_orf function in bgpd in Quagga 0.99.20.1 and earlier allows remote attackers to cause a denial of service (assertion failure and daemon exit) by leveraging a BGP peering relationship and sending a malformed Outbound Route Filtering (ORF) capability TLV in an OPEN message. RHSA-2012:1259 DSA-2497 VU#962587 53775 USN-1605-1 The Network Threat Protection module in the Manager component in Symantec Endpoint Protection (SEP) 11.0.600x through 11.0.700x on Windows Server 2003 allows remote attackers to cause a denial of service (web-server outage, or daemon crash or hang) via a flood of packets that triggers automated blocking of network traffic. VU#149070 50358 1027092 http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120522_00 sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case. http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/ HPSBMU02786 APPLE-SA-2012-09-19-2 openSUSE-SU-2012:0590 SUSE-SU-2012:0598 SUSE-SU-2012:0604 SSRT100856 RHSA-2012:0546 RHSA-2012:0547 RHSA-2012:0568 RHSA-2012:0569 RHSA-2012:0570 http://support.apple.com/kb/HT5501 DSA-2465 VU#520827 VU#673343 MDVSA-2012:068 http://www.php.net/archive/2012.php#id2012-05-03-1 http://www.php.net/ChangeLog-5.php#5.4.2 1027022 https://bugs.php.net/bug.php?id=61910 https://bugs.php.net/patch-display.php?bug_id=61910&patch=cgi.diff&revision=1335984315&display=1 Untrusted search path vulnerability in Measuresoft ScadaPro Client before 4.0.0 and ScadaPro Server before 4.0.0 allows local users to gain privileges via a Trojan horse DLL in the current working directory. http://www.measuresoft.net/downloads/Measuresoft%20SCADA%204.4.6/issue_disks/Client/DOCUMENTATION/ReleaseNotes.doc http://www.measuresoft.net/downloads/Measuresoft%20SCADA%204.4.6/issue_disks/Server/DOCUMENTATION/ReleaseNotes.doc http://www.us-cert.gov/control_systems/pdf/ICSA-12-145-01.pdf Multiple cross-site scripting (XSS) vulnerabilities in the status program on the ForeScout CounterACT appliance with software 6.3.3.2 through 6.3.4.10 allow remote attackers to inject arbitrary web script or HTML via (1) the loginname parameter in a forgotpass action or (2) the username parameter. VU#815532 http://www.kb.cert.org/vuls/id/MAPG-8TWMEJ dotCMS 1.9 before 1.9.5.1 allows remote authenticated users to execute arbitrary Java code via a crafted (1) XSLT or (2) Velocity template. http://dotcms.com/dotCMSVersions/ VU#898083 53688 https://gist.github.com/2627440 https://github.com/dotCMS/dotCMS/issues/261 https://github.com/dotCMS/dotCMS/issues/281 The web service in AutoFORM PDM Archive before 7.1 does not have authorization requirements, which allows remote authenticated users to perform database operations via a SOAP request, as demonstrated by the initializeQueryDatabase2 request. VU#773035 http://www.kb.cert.org/vuls/id/MAPG-8RQL83 53716 The administrative functions in AutoFORM PDM Archive before 7.1 do not have authorization requirements, which allows remote authenticated users to perform administrative actions by leveraging knowledge of a hidden function, as demonstrated by the password-change function. VU#773035 http://www.kb.cert.org/vuls/id/MAPG-8RQL83 53716 Multiple cross-site scripting (XSS) vulnerabilities in AutoFORM PDM Archive before 6.920 allow remote authenticated users to inject arbitrary web script or HTML via unspecified fields. VU#773035 http://www.kb.cert.org/vuls/id/MAPG-8RQL83 53716 Stack-based buffer overflow in WellinTech KingView 6.53 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 555. Per: http://www.wellintech.com/index.php/news/33-patch-for-kingview653 "KingView with the version 65.30.17249( TouchExplorer: 65.30.2003.17249; TouchVew: 65.30.2003.17376) and also the previous version is affected." http://www.us-cert.gov/control_systems/pdf/ICSA-12-185-01.pdf http://www.wellintech.com/index.php/news/33-patch-for-kingview653 Heap-based buffer overflow in WellinTech KingView 6.53 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 555. http://www.us-cert.gov/control_systems/pdf/ICSA-12-185-01.pdf http://www.wellintech.com/index.php/news/33-patch-for-kingview653 WellinTech KingView 6.53 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via a crafted packet to (1) TCP or (2) UDP port 2001. http://www.us-cert.gov/control_systems/pdf/ICSA-12-185-01.pdf http://www.wellintech.com/index.php/news/33-patch-for-kingview653 VMware SpringSource Grails before 1.3.8, and 2.x before 2.0.2, does not properly restrict data binding, which might allow remote attackers to bypass intended access restrictions and modify arbitrary object properties via a crafted request parameter to an application. http://support.springsource.com/security/cve-2012-1833 55763 Cross-site scripting (XSS) vulnerability in the cms_tpv_admin_head function in functions.php in the CMS Tree Page View plugin before 0.8.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cms_tpv_view parameter to wp-admin/options-general.php. http://plugins.trac.wordpress.org/changeset/523576/cms-tree-page-view http://wordpress.org/extend/plugins/cms-tree-page-view/changelog/ 52708 wordpress-cmstree-edit-xss(74337) https://www.htbridge.com/advisory/HTB23083 Multiple cross-site scripting (XSS) vulnerabilities in the All-in-One Event Calendar plugin 1.4 and 1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) title parameter to app/view/agenda-widget-form.php; (2) args, (3) title, (4) before_title, or (5) after_title parameter to app/view/agenda-widget.php; (6) button_value parameter to app/view/box_publish_button.php; or (7) msg parameter to /app/view/save_successful.php. 20120411 Multiple XSS vulnerabilities in All-in-One Event Calendar Plugin for WordPress 52986 https://www.htbridge.com/advisory/HTB23082 Heap-based buffer overflow in dns.cpp in InspIRCd 2.0.5 might allow remote attackers to execute arbitrary code via a crafted DNS query that uses compression. 80263 48474 DSA-2448 VU#212651 52561 inspircd-dns-bo(74157) https://github.com/inspircd/inspircd/commit/fe7dbd2c104c37f6f3af7d9f1646a3c332aea4a4 The (1) webreports, (2) post/create-role, and (3) post/update-role programs in IBM Tivoli Endpoint Manager (TEM) before 8.2 do not include the HTTPOnly flag in a Set-Cookie header for a cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie. http://www-01.ibm.com/support/docview.wss?uid=swg21587743 tem-httponly-weak-security(74038) The web management interface on the LG-Nortel ELO GS24M switch allows remote attackers to bypass authentication, and consequently obtain cleartext credential and configuration information, via a direct request to a configuration web page. 80370 VU#523027 lgnortel-switch-info-disclosure(74237) Multiple directory traversal vulnerabilities in the Get Template feature in plugins/gui.ajax/class.AJXP_ClientDriver.php in AjaXplorer 3.2.x before 3.2.5 and 4.0.x before 4.0.4 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) pluginName or (2) pluginPath parameter in a get_template action. NOTE: some of these details are obtained from third party information. http://ajaxplorer.info/ajaxplorer-4-0-4/ VU#504019 52298 ajaxplorer-ajxpclientdriver-file-include(73671) AjaXplorer 3.2.x before 3.2.5 and 4.0.x before 4.0.4 does not properly perform cookie authentication, which allows remote attackers to obtain login access by leveraging knowledge of a password hash. http://ajaxplorer.info/ajaxplorer-4-0-4/ VU#504019 ajaxplorer-cookie-info-disc(74305) Absolute path traversal vulnerability in logShow.htm on the Quantum Scalar i500 tape library with firmware before i7.0.3 (604G.GS00100), also distributed as the Dell ML6000 tape library with firmware before A20-00 (590G.GS00100), allows remote attackers to read arbitrary files via a full pathname in the file parameter. 80226 48403 48453 VU#913483 http://www.kb.cert.org/vuls/id/MAPG-8NNKN8 http://www.kb.cert.org/vuls/id/MAPG-8NVRPY Cross-site scripting (XSS) vulnerability in checkQKMProg.htm on the Quantum Scalar i500 tape library with firmware before i7.0.3 (604G.GS00100), also distributed as the Dell ML6000 tape library with firmware before A20-00 (590G.GS00100), allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. 80225 48403 48453 VU#913483 http://www.kb.cert.org/vuls/id/MAPG-8NNKN8 http://www.kb.cert.org/vuls/id/MAPG-8NVRPY Cross-site request forgery (CSRF) vulnerability in saveRestore.htm on the Quantum Scalar i500 tape library with firmware before i7.0.3 (604G.GS00100), also distributed as the Dell ML6000 tape library with firmware before A20-00 (590G.GS00100), allows remote attackers to hijack the authentication of users for requests that execute Linux commands via the fileName parameter, related to a "command-injection vulnerability." 80227 48403 48453 VU#913483 http://www.kb.cert.org/vuls/id/MAPG-8NNKN8 http://www.kb.cert.org/vuls/id/MAPG-8NVRPY scalar-unspec-csrf(74161) The Quantum Scalar i500 tape library with firmware before i7.0.3 (604G.GS00100), also distributed as the Dell ML6000 tape library with firmware before A20-00 (590G.GS00100) and the IBM TS3310 tape library with firmware before R6C (606G.GS001), uses default passwords for unspecified user accounts, which makes it easier for remote attackers to obtain access via unknown vectors. 80372 VU#913483 http://www.kb.cert.org/vuls/id/MAPG-8NNKN8 http://www.kb.cert.org/vuls/id/MAPG-8NVRPY http://www.kb.cert.org/vuls/id/MORO-8QNJLE scalar-default-account(74322) Use-after-free vulnerability in Google Chrome 17.0.963.66 and earlier allows remote attackers to bypass the DEP and ASLR protection mechanisms, and execute arbitrary code, via unspecified vectors, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012. NOTE: the primary affected product may be clarified later; it was not identified by the researcher, who reportedly stated "it really doesn't matter if it's third-party code." http://pwn2own.zerodayinitiative.com/status.html http://twitter.com/vupen/statuses/177576000761237505 http://www.forbes.com/sites/andygreenberg/2012/03/21/meet-the-hackers-who-sell-spies-the-tools-to-crack-your-pc-and-get-paid-six-figure-fees/ http://www.zdnet.com/blog/security/pwn2own-2012-google-chrome-browser-sandbox-first-to-fall/10588 google-chrome-dep-code-execution(74323) oval:org.mitre.oval:def:14843 Google Chrome 17.0.963.66 and earlier allows remote attackers to bypass the sandbox protection mechanism by leveraging access to a sandboxed process, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012. NOTE: the primary affected product may be clarified later; it was not identified by the researcher, who reportedly stated "it really doesn't matter if it's third-party code." http://pwn2own.zerodayinitiative.com/status.html http://twitter.com/vupen/statuses/177576000761237505 http://www.forbes.com/sites/andygreenberg/2012/03/21/meet-the-hackers-who-sell-spies-the-tools-to-crack-your-pc-and-get-paid-six-figure-fees/ http://www.zdnet.com/blog/security/pwn2own-2012-google-chrome-browser-sandbox-first-to-fall/10588 chrome-sandbox-security-bypass(74324) oval:org.mitre.oval:def:14940 Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Office 2008 and 2011 for Mac; Excel Viewer; and Office Compatibility Pack SP2 and SP3 do not properly handle memory during the opening of files, which allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Excel Series Record Parsing Type Mismatch Could Result in Remote Code Execution Vulnerability." 53379 1027041 TA12-129A MS12-030 ms-excel-series-code-execution(75119) oval:org.mitre.oval:def:15575 win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and Windows 8 Consumer Preview does not properly handle user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Scrollbar Calculation Vulnerability." 53327 1027039 TA12-129A MS12-034 oval:org.mitre.oval:def:15555 Untrusted search path vulnerability in Microsoft Lync 2010, 2010 Attendee, and 2010 Attendant allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .ocsmeet file, aka "Lync Insecure Library Loading Vulnerability." Per: http://cwe.mitre.org/data/definitions/426.html 'CWE-426: Untrusted Search Path' Per: http://technet.microsoft.com/en-us/security/bulletin/ms12-039 AV:N per "How could an attacker exploit the vulnerability? An attacker could convince a user to open a legitimate Microsoft Lync related file (such as an .ocsmeet file) that is located in the same network directory as a specially crafted dynamic link library (DLL) file. Then, while opening the legitimate file, Microsoft Lync could attempt to load the DLL file and execute any code it contained. In an email attack scenario, an attacker could exploit the vulnerability by sending a legitimate Microsoft Lync-related file (such as an .ocsmeet file) to a user, and convincing the user to place the attachment into a directory that contains a specially crafted DLL file and to open the legitimate file. Then, while opening the legitimate file, Microsoft Lync could attempt to load the DLL file and execute any code it contained. In a network attack scenario, an attacker could place a legitimate Microsoft Lync-related file and a specially crafted DLL in a network share, a UNC, or WebDAV location and then convince the user to open the file." TA12-164A MS12-039 oval:org.mitre.oval:def:14874 The Remote Administration Protocol (RAP) implementation in the LanmanWorkstation service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle RAP responses, which allows remote attackers to cause a denial of service (service hang) via crafted RAP packets, aka "Remote Administration Protocol Denial of Service Vulnerability." TA12-227A MS12-054 oval:org.mitre.oval:def:15669 Format string vulnerability in the Print Spooler service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted response, aka "Print Spooler Service Format String Vulnerability." TA12-227A MS12-054 oval:org.mitre.oval:def:15531 Heap-based buffer overflow in the Remote Administration Protocol (RAP) implementation in the LanmanWorkstation service in Microsoft Windows XP SP2 and SP3 allows remote attackers to execute arbitrary code via crafted RAP response packets, aka "Remote Administration Protocol Heap Overflow Vulnerability." TA12-227A MS12-054 oval:org.mitre.oval:def:15079 Stack-based buffer overflow in the Remote Administration Protocol (RAP) implementation in the LanmanWorkstation service in Microsoft Windows XP SP3 allows remote attackers to execute arbitrary code via crafted RAP response packets, aka "Remote Administration Protocol Stack Overflow Vulnerability." TA12-227A MS12-054 oval:org.mitre.oval:def:15408 Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic for Applications SDK allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka "Visual Basic for Applications Insecure Library Loading Vulnerability," as exploited in the wild in July 2012. Per: http://cwe.mitre.org/data/definitions/426.html 'CWE-426: Untrusted Search Path' TA12-192A MS12-046 oval:org.mitre.oval:def:14950 Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly handle function pointers, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application, aka ".NET Framework Memory Access Vulnerability." TA12-164A MS12-038 oval:org.mitre.oval:def:14717 The TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office 2003 SP3, Office 2003 Web Components SP3, Office 2007 SP2 and SP3, Office 2010 SP1, SQL Server 2000 SP4, SQL Server 2005 SP4, SQL Server 2008 SP2, SP3, R2, R2 SP1, and R2 SP2, Commerce Server 2002 SP4, Commerce Server 2007 SP2, Commerce Server 2009 Gold and R2, Host Integration Server 2004 SP1, Visual FoxPro 8.0 SP1, Visual FoxPro 9.0 SP2, and Visual Basic 6.0 Runtime allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption, aka "MSCOMCTL.OCX RCE Vulnerability." 54948 TA12-227A MS12-060 oval:org.mitre.oval:def:15447 Cross-site scripting (XSS) vulnerability in the Enterprise Portal component in Microsoft Dynamics AX 2012 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "Dynamics AX Enterprise Portal XSS Vulnerability." TA12-164A MS12-040 The toStaticHTML API (aka the SafeHTML component) in Microsoft Internet Explorer 8 and 9, Communicator 2007 R2, and Lync 2010 and 2010 Attendee does not properly handle event attributes and script, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted HTML document, aka "HTML Sanitization Vulnerability." TA12-164A TA12-192A MS12-037 MS12-039 MS12-050 oval:org.mitre.oval:def:15530 Cross-site scripting (XSS) vulnerability in scriptresx.ashx in Microsoft SharePoint Server 2010 Gold and SP1, SharePoint Foundation 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL, aka "XSS scriptresx.ashx Vulnerability." TA12-192A MS12-050 oval:org.mitre.oval:def:15589 Microsoft Office SharePoint Server 2007 SP2 and SP3, SharePoint Server 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 do not properly check permissions for search scopes, which allows remote authenticated users to obtain sensitive information or cause a denial of service (data modification) by changing a parameter in a search-scope URL, aka "SharePoint Search Scope Vulnerability." MS12-050 oval:org.mitre.oval:def:15265 Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 Gold and SP1, SharePoint Foundation 2010 Gold and SP1, and Office Web Apps 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL, aka "SharePoint Script in Username Vulnerability." TA12-192A MS12-050 oval:org.mitre.oval:def:15544 Open redirect vulnerability in Microsoft Office SharePoint Server 2007 SP2 and SP3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL, aka "SharePoint URL Redirection Vulnerability." MS12-050 oval:org.mitre.oval:def:15657 Cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server 2007 SP2 and SP3 Windows SharePoint Services 3.0 SP2, and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via crafted JavaScript elements in a URL, aka "SharePoint Reflected List Parameter Vulnerability." TA12-192A MS12-050 oval:org.mitre.oval:def:15689 win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle user-mode input passed to kernel mode for driver objects, which allows local users to gain privileges via a crafted application, aka "String Atom Class Name Handling Vulnerability," a different vulnerability than CVE-2012-1865. TA12-164A MS12-041 oval:org.mitre.oval:def:15496 win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle user-mode input passed to kernel mode for driver objects, which allows local users to gain privileges via a crafted application, aka "String Atom Class Name Handling Vulnerability," a different vulnerability than CVE-2012-1864. TA12-164A MS12-041 oval:org.mitre.oval:def:15649 win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle user-mode input passed to kernel mode for driver objects, which allows local users to gain privileges via a crafted application, aka "Clipboard Format Atom Name Handling Vulnerability." TA12-164A MS12-041 oval:org.mitre.oval:def:15096 Integer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted TrueType font file that triggers incorrect memory allocation, aka "Font Resource Refcount Integer Overflow Vulnerability." TA12-164A MS12-041 oval:org.mitre.oval:def:15510 Race condition in the thread-creation implementation in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP3 allows local users to gain privileges via a crafted application, aka "Win32k.sys Race Condition Vulnerability." TA12-164A MS12-041 oval:org.mitre.oval:def:15647 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012. Notes: none. The CBC mode in the TLS protocol, as used in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, and other products, allows remote web servers to obtain plaintext data by triggering multiple requests to a third-party HTTPS server and sniffing the network during the resulting HTTPS session, aka "TLS Protocol Vulnerability." TA12-192A MS12-049 oval:org.mitre.oval:def:15644 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012. Notes: none. Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 6 through 9 allows remote attackers to inject arbitrary web script or HTML via crafted character sequences with EUC-JP encoding, aka "EUC-JP Character Encoding Vulnerability." MS12-037 oval:org.mitre.oval:def:15629 Microsoft Internet Explorer 7 through 9 does not properly create and initialize string data, which allows remote attackers to obtain sensitive information from process memory via a crafted HTML document, aka "Null Byte Information Disclosure Vulnerability." TA12-164A MS12-037 oval:org.mitre.oval:def:15026 Microsoft Internet Explorer 8 and 9 does not properly handle objects in memory, which allows user-assisted remote attackers to execute arbitrary code by accessing a deleted object, aka "Developer Toolbar Remote Code Execution Vulnerability." TA12-164A MS12-037 oval:org.mitre.oval:def:15425 Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Same ID Property Remote Code Execution Vulnerability." TA12-164A MS12-037 oval:org.mitre.oval:def:15663 Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access a nonexistent object, leading to a heap-based buffer overflow, aka "Col Element Remote Code Execution Vulnerability," as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012. http://arstechnica.com/business/news/2012/03/ie-9-on-latest-windows-gets-stomped-at-hacker-contest.ars http://pwn2own.zerodayinitiative.com/status.html http://twitter.com/vupen/statuses/177895844828291073 TA12-164A http://www.zdnet.com/blog/security/pwn2own-2012-ie-9-hacked-with-two-0day-vulnerabilities/10621 MS12-037 oval:org.mitre.oval:def:15539 Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Title Element Change Remote Code Execution Vulnerability." TA12-164A MS12-037 oval:org.mitre.oval:def:15472 Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "OnBeforeDeactivate Event Remote Code Execution Vulnerability." TA12-164A MS12-037 oval:org.mitre.oval:def:15632 Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access an undefined memory location, aka "insertAdjacentText Remote Code Execution Vulnerability." TA12-164A MS12-037 oval:org.mitre.oval:def:15588 Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "insertRow Remote Code Execution Vulnerability." TA12-164A MS12-037 oval:org.mitre.oval:def:14975 Microsoft Internet Explorer 8 and 9 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "OnRowsInserted Event Remote Code Execution Vulnerability." TA12-164A MS12-037 oval:org.mitre.oval:def:15378 Microsoft Internet Explorer 6 through 9 does not block cross-domain scrolling events, which allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Scrolling Events Information Disclosure Vulnerability." MS12-037 oval:org.mitre.oval:def:15367 ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012. Notes: none. ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2012. Notes: none. Heap-based buffer overflow in Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Office 2008 and 2011 for Mac; and Office Compatibility Pack SP2 and SP3 allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Excel SerAuxErrBar Heap Overflow Vulnerability." 56425 1027752 TA12-318A MS12-076 ms-excel-serauxerrbar-bo(78072) oval:org.mitre.oval:def:15752 oval:org.mitre.oval:def:15916 Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Excel Viewer; and Office Compatibility Pack SP2 and SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted spreadsheet, aka "Excel Memory Corruption Vulnerability." 56426 1027752 TA12-318A MS12-076 microsoft-excel-code-exec(78073) oval:org.mitre.oval:def:15927 Use-after-free vulnerability in Microsoft Excel 2003 SP3, 2007 SP2 and SP3, and 2010 SP1, and Office 2008 and 2011 for Mac, allows remote attackers to execute arbitrary code via a crafted spreadsheet, aka "Excel SST Invalid Length Use After Free Vulnerability." 56430 1027752 TA12-318A MS12-076 microsoft-excel-ssl-code-exec(78074) oval:org.mitre.oval:def:15717 oval:org.mitre.oval:def:15970 Buffer overflow in Microsoft Visio 2010 SP1 and Visio Viewer 2010 SP1 allows remote attackers to execute arbitrary code via a crafted Visio file, aka "Visio DXF File Format Buffer Overflow Vulnerability." TA12-227A MS12-059 oval:org.mitre.oval:def:15811 Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. http://technet.microsoft.com/security/advisory/2719615 TA12-174A TA12-192A MS12-043 oval:org.mitre.oval:def:15195 win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle keyboard-layout files, which allows local users to gain privileges via a crafted application, aka "Keyboard Layout Vulnerability." TA12-192A MS12-047 oval:org.mitre.oval:def:15416 Heap-based buffer overflow in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2 and Windows Data Access Components (WDAC) 6.0 allows remote attackers to execute arbitrary code via crafted XML data that triggers access to an uninitialized object in memory, aka "ADO Cachesize Heap Overflow RCE Vulnerability." TA12-192A MS12-045 oval:org.mitre.oval:def:14783 Cross-site scripting (XSS) vulnerability in Microsoft Visual Studio Team Foundation Server 2010 SP1 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka "XSS Vulnerability." 55409 1027511 TA12-255A MS12-061 oval:org.mitre.oval:def:15779 win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly validate callback parameters during creation of a hook procedure, which allows local users to gain privileges via a crafted application, aka "Win32k Incorrect Type Handling Vulnerability." TA12-192A MS12-047 oval:org.mitre.oval:def:15654 Microsoft Office for Mac 2011 uses world-writable permissions for the "Applications/Microsoft Office 2011/" directory and certain other directories, which allows local users to gain privileges by placing a Trojan horse executable file in one of these directories, aka "Office for Mac Improper Folder Permissions Vulnerability." TA12-192A MS12-051 oval:org.mitre.oval:def:15602 The reflection implementation in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5.1, and 4 does not properly enforce object permissions, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application, aka "Reflection Bypass Vulnerability." 1027753 TA12-318A MS12-074 oval:org.mitre.oval:def:15924 Microsoft .NET Framework 2.0 SP2 and 3.5.1 does not properly consider trust levels during construction of output data, which allows remote attackers to obtain sensitive information via (1) a crafted XAML browser application (aka XBAP) or (2) a crafted .NET Framework application, aka "Code Access Security Info Disclosure Vulnerability." 56456 1027753 TA12-318A MS12-074 oval:org.mitre.oval:def:15785 Multiple cross-site request forgery (CSRF) vulnerabilities in Wolf CMS 0.75 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) delete users via the user id number to admin/user/delete; (2) delete pages via the page id number to admin/page/delete; delete the (3) images or (4) themes directory via the directory name to admin/plugin/file_manager/delete, and possibly other directories; or (5) logout the user via a request to admin/login/logout. http://packetstormsecurity.org/files/111116/Wolfcms-0.75-Cross-Site-Request-Forgery-Cross-Site-Scripting.html http://www.webapp-security.com/2012/03/wolfcms/ http://www.webapp-security.com/wp-content/uploads/2012/03/Wolfcms-0.75-Multiple-Vulnerabilities-CSRF-XSS.txt Multiple cross-site scripting (XSS) vulnerabilities in wolfcms/admin/user/add in Wolf CMS 0.75 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) user[name], (2) user[email], or (3) user[username] parameters. http://packetstormsecurity.org/files/111116/Wolfcms-0.75-Cross-Site-Request-Forgery-Cross-Site-Scripting.html http://www.webapp-security.com/2012/03/wolfcms/ http://www.webapp-security.com/wp-content/uploads/2012/03/Wolfcms-0.75-Multiple-Vulnerabilities-CSRF-XSS.txt Multiple cross-site scripting (XSS) vulnerabilities in webfolio/admin/users/edit in Webfolio CMS 1.1.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) First name, (2) Last name or (3) Email (required) fields. http://ivanobinetti.blogspot.com/2012/03/webfolio-114-multiple-xss.html http://packetstormsecurity.org/files/110524/Webfolio-CMS-1.1.4-Cross-Site-Scripting.html 52335 webfoliocms-multiple-xss(73738) Cross-site request forgery (CSRF) vulnerability in admin/index.php in RazorCMS 1.2.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that delete arbitrary web pages via a showcats action. http://packetstormsecurity.org/files/110593/RazorCMS-1.2.1-STABLE-Cross-Site-Request-Forgery.html 18575 razorcms-deletewebpage-csrf(73902) Multiple cross-site request forgery (CSRF) vulnerabilities in FlexCMS 3.2.1 and earlier allow remote attackers to (1) hijack the authentication of users for requests that change account settings via a request to index.php/profile-edit-save or (2) hijack the authentication of administrators for requests that add a new page via a request to admin/pages-new-save. http://ivanobinetti.blogspot.com/2012/03/flexcms-multiple-csrf-vulnerabilities.html 18609 show_config_errors.php in phpMyAdmin 3.4.x before 3.4.10.2, when a configuration file does not exist, allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message about this missing file. FEDORA-2012-5631 FEDORA-2012-5624 FEDORA-2012-5599 MDVSA-2012:050 http://www.phpmyadmin.net/home_page/security/PMASA-2012-2.php 52858 phpmyadmin-showconfigerrors-path-disclosure(74608) https://github.com/phpmyadmin/phpmyadmin/commit/c51817d3b8cb05ff54dca9373c0667e29b8498d4 mp4fformat.dll in the QuickTime File Format plugin in RealNetworks RealPlayer 15 and earlier, and RealPlayer SP 1.1.4 Build 12.0.0.756 and earlier, allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted MP4 file. http://packetstormsecurity.org/files/111162/RealPlayer-1.1.4-Memory-Corruption.html 1027076 Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp. http://projects.puppetlabs.com/issues/13260 http://puppetlabs.com/security/cve/cve-2012-1906/ USN-1419-1 DSA-2451 52975 puppet-macosx-symlink(74793) The scanner engine in PrivaWall Antivirus 5.6 and earlier does not recognize the Office XML (aka Open Document XML) file format, which allows remote attackers to bypass malware detection via a crafted file embedded in a WordML document. 20120313 PrivaWall Antivirus Office XML Format Evasion/Bypass Vulnerability Cross-site scripting (XSS) vulnerability in Splunk 4.0 through 4.3 allows remote attackers to inject arbitrary web script or HTML via unknown vectors. http://www.splunk.com/view/SP-CAAAGTK#38585 The Bitcoin protocol, as used in bitcoind before 0.4.4, wxBitcoin, Bitcoin-Qt, and other programs, does not properly handle multiple transactions with the same identifier, which allows remote attackers to cause a denial of service (unspendable transaction) by leveraging the ability to create a duplicate coinbase transaction. http://r6.ca/blog/20120206T005236Z.html [bitcoin-development] 20120228 Duplicate transactions vulnerability https://bitcointalk.org/index.php?topic=67738.0 https://bugs.gentoo.org/show_bug.cgi?id=407793 https://en.bitcoin.it/wiki/BIP_0030 https://en.bitcoin.it/wiki/CVEs https://github.com/sipa/bitcoin/commit/a206b0ea12eb4606b93323268fc81a4f1f952531 Bitcoin-Qt 0.5.0.x before 0.5.0.5; 0.5.1.x, 0.5.2.x, and 0.5.3.x before 0.5.3.1; and 0.6.x before 0.6.0rc4 on Windows does not use MinGW multithread-safe exception handling, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via crafted Bitcoin protocol messages. http://gavintech.blogspot.com/2012/03/full-disclosure-bitcoin-qt-on-windows.html https://bitcointalk.org/index.php?topic=69120.0 https://en.bitcoin.it/wiki/CVEs https://github.com/bitcoin/bitcoin/commit/8864019f6d88b13d3442843d9e6ebeb8dd938831 Multiple SQL injection vulnerabilities in PHP Address Book 6.2.12 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) to_group parameter to group.php or (2) id parameter to vcard.php. NOTE: the edit.php vector is already covered by CVE-2008-2565. http://sourceforge.net/tracker/?func=detail&aid=3496653&group_id=157964&atid=805929 http://sourceforge.net/tracker/?func=detail&aid=3501716&group_id=157964&atid=805929 http://www.darksecurity.de/advisories/2012/SSCHADV2012-007.txt 18578 52396 phpaddressbook-multiple-sql-injection(73943) Cross-site scripting (XSS) vulnerability in preferences.php in PHP Address Book 7.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the from parameter. NOTE: the index.php vector is already covered by CVE-2008-2566. http://sourceforge.net/tracker/?func=detail&aid=3496653&group_id=157964&atid=805929 http://sourceforge.net/tracker/?func=detail&aid=3501716&group_id=157964&atid=805929 http://sourceforge.net/tracker/?func=detail&aid=3527242&group_id=157964&atid=805929 http://www.darksecurity.de/advisories/2012/SSCHADV2012-007.txt http://www.darksecurity.de/index.php?/215-SSCHADV2012-013-PHP-Address-Book-7.0.0-Multiple-security-vulnerabilities.html 18578 52396 53598 phpaddressbook-multiple-xss(73944) ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2010-0754. Reason: This candidate is a reservation duplicate of CVE-2010-0754. Notes: All CVE users should reference CVE-2010-0754 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. @Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to execute arbitrary code via an e-mail attachment with an executable extension, leading to the creation of an executable file under tmp/. Per: http://www.kb.cert.org/vuls/id/743555 'CWE-434: Unrestricted Upload of File with Dangerous Type' http://atmail.org/download/atmailopen.tgz http://en.securitylab.ru/lab/PT-2011-48 VU#743555 compose.php in @Mail WebMail Client in AtMail Open-Source before 1.05 does not properly handle ../ (dot dot slash) sequences in the unique parameter, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ..././ (dot dot dot slash dot slash) sequence. http://atmail.org/download/atmailopen.tgz http://en.securitylab.ru/lab/PT-2011-48 VU#743555 Multiple directory traversal vulnerabilities in (1) compose.php and (2) libs/Atmail/SendMsg.php in @Mail WebMail Client in AtMail Open-Source before 1.05 allow remote attackers to read arbitrary files via a .. (dot dot) in the Attachment[] parameter. http://atmail.org/download/atmailopen.tgz http://en.securitylab.ru/lab/PT-2011-48 VU#743555 atmail-sendmsg-directory-traversal(74504) CRLF injection vulnerability in mime.php in @Mail WebMail Client in AtMail Open-Source before 1.05 allows remote attackers to conduct directory traversal attacks and read arbitrary files via a %0A sequence followed by a .. (dot dot) in the file parameter. http://atmail.org/download/atmailopen.tgz http://en.securitylab.ru/lab/PT-2011-48 VU#743555 @Mail WebMail Client in AtMail Open-Source 1.04 and earlier allows remote attackers to obtain configuration information via a direct request to install/info.php, which calls the phpinfo function. http://en.securitylab.ru/lab/PT-2011-48 VU#743555 atmail-info-info-disclosure(74282) Cross-site request forgery (CSRF) vulnerability in goform/admin/formWlEncrypt in Sitecom WLM-2501 allows remote attackers to hijack the authentication of administrators for requests that change the router passphrase via the pskValue parameter. http://ivanobinetti.blogspot.com/2012/03/sitecom-wlm-2501-change-wireless.html http://packetstormsecurity.org/files/110770/Sitecom-WLM-2501-Cross-Site-Request-Forgery.html Multiple cross-site request forgery (CSRF) vulnerabilities in Sitecom WLM-2501 allow remote attackers to hijack the authentication of administrators for requests that modify settings for (1) Mac Filtering via admin/formFilter, (2) IP/Port Filtering via formFilter, (3) Port Forwarding via formPortFw, (4) Wireless Access Control via admin/formWlAc, (5) Wi-Fi Protected Setup via formWsc, (6) URL Blocking Filter via formURL, (7) Domain Blocking Filter via formDOMAINBLK, and (8) IP Address ACL Filter via admin/formACL in goform/, different vectors than CVE-2012-1921. http://www.webapp-security.com/2012/03/sitecom-wlm-2501-multiple-csrf-vulnerabilities http://www.webapp-security.com/wp-content/uploads/2012/03/Sitecom-WLM-2501-new-Multiple-CSRF-Vulnerabilities-1.txt RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x store passwords in cleartext under adm_b_db\users\, which allows local users to obtain sensitive information by reading a database. 20120409 Secunia Research: RealNetworks Helix Server Credentials Disclosure Security Issue http://helixproducts.real.com/docs/security/SecurityUpdate04022012HS.pdf 52929 1026898 helix-server-info-disclosure(74673) Opera before 11.62 allows user-assisted remote attackers to trick users into downloading and executing arbitrary files via a small window for the download dialog. openSUSE-SU-2012:0610 80620 48535 http://www.opera.com/docs/changelogs/mac/1162/ http://www.opera.com/docs/changelogs/unix/1162/ http://www.opera.com/docs/changelogs/windows/1162/ http://www.opera.com/support/kb/view/1010/ opera-dialog-box-code-execution(74349) Opera before 11.62 does not ensure that a dialog window is placed on top of content windows, which makes it easier for user-assisted remote attackers to trick users into downloading and executing arbitrary files via a download dialog located under other windows. openSUSE-SU-2012:0610 80621 48535 http://www.opera.com/docs/changelogs/mac/1162/ http://www.opera.com/docs/changelogs/unix/1162/ http://www.opera.com/docs/changelogs/windows/1162/ http://www.opera.com/support/kb/view/1011/ opera-content-window-code-exec(74503) Opera before 11.62 allows remote attackers to bypass the Same Origin Policy via the (1) history.pushState and (2) history.replaceState functions in conjunction with cross-domain frames, leading to unintended read access to history.state information. openSUSE-SU-2012:0610 80622 48535 http://www.opera.com/docs/changelogs/mac/1162/ http://www.opera.com/docs/changelogs/unix/1162/ http://www.opera.com/docs/changelogs/windows/1162/ http://www.opera.com/support/kb/view/1012/ opera-historypushstate-info-disclosure(74351) Opera before 11.62 allows remote attackers to spoof the address field by triggering the launch of a dialog window associated with a different domain. openSUSE-SU-2012:0610 80623 48535 http://www.opera.com/docs/changelogs/mac/1162/ http://www.opera.com/docs/changelogs/unix/1162/ http://www.opera.com/docs/changelogs/windows/1162/ http://www.opera.com/support/kb/view/1013/ opera-address-field-spoofing(74502) Opera before 11.62 allows remote attackers to spoof the address field by triggering a page reload followed by a redirect to a different domain. openSUSE-SU-2012:0610 80624 48535 http://www.opera.com/docs/changelogs/mac/1162/ http://www.opera.com/docs/changelogs/unix/1162/ http://www.opera.com/docs/changelogs/windows/1162/ http://www.opera.com/support/kb/view/1014/ opera-redirects-spoofing(74353) Opera before 11.62 on Mac OS X allows remote attackers to spoof the address field and security dialogs via crafted styling that causes page content to be displayed outside of the intended content area. openSUSE-SU-2012:0610 48535 http://www.opera.com/docs/changelogs/mac/1162/ http://www.opera.com/docs/changelogs/windows/1162/ http://www.opera.com/support/kb/view/1009/ http://www.opera.com/support/kb/view/1013/ opera-dialogs-spoofing(74352) Opera before 11.62 on UNIX uses world-readable permissions for temporary files during printing, which allows local users to obtain sensitive information by reading these files. openSUSE-SU-2012:0610 48535 http://www.opera.com/docs/changelogs/unix/1162/ http://www.opera.com/support/kb/view/1015/ opera-printing-info-disclosure(74501) Opera before 11.62 on UNIX, when used in conjunction with an unspecified printing application, allows local users to overwrite arbitrary files via a symlink attack on a temporary file during printing. openSUSE-SU-2012:0610 48535 http://www.opera.com/docs/changelogs/unix/1162/ http://www.opera.com/support/kb/view/1015/ opera-printing-symlink(74500) Multiple PHP remote file inclusion vulnerabilities in Newscoop 3.5.x before 3.5.5 and 4 before RC4, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via a URL in the GLOBALS[g_campsiteDir] parameter to (1) include/phorum_load.php, (2) conf/install_conf.php, or (3) conf/liveuser_configuration.php. 20120418 Multiple vulnerabilities in Newscoop http://dev.sourcefabric.org/browse/CS-4179 18752 53147 http://www.sourcefabric.org/en/newscoop/latestrelease/1141/Newscoop-355-and-Newscoop-4-RC4-security-releases.htm newscoop-gcampsitedir-file-include(75031) https://www.htbridge.com/advisory/HTB23084 SQL injection vulnerability in admin/country/edit.php in Newscoop before 3.5.5 and 4.x before 4 RC4 allows remote attackers to execute arbitrary SQL commands via the f_country_code parameter. 20120418 Multiple vulnerabilities in Newscoop http://dev.sourcefabric.org/browse/CS-4179 http://dev.sourcefabric.org/browse/CS-4181 18752 52941 http://www.sourcefabric.org/en/newscoop/latestrelease/1141/Newscoop-355-and-Newscoop-4-RC4-security-releases.htm newscoop-edit-sql-injection(74780) https://www.htbridge.com/advisory/HTB23084 Multiple cross-site scripting (XSS) vulnerabilities in Newscoop 3.5.x before 3.5.5 and 4.x before 4 RC4 allow remote attackers to inject arbitrary web script or HTML via the (1) Back parameter to admin/ad.php, or the (2) token or (3) f_email parameter to admin/password_check_token.php. 20120418 Multiple vulnerabilities in Newscoop http://dev.sourcefabric.org/browse/CS-4179 http://dev.sourcefabric.org/browse/CS-4182 http://dev.sourcefabric.org/browse/CS-4183 18752 52941 http://www.sourcefabric.org/en/newscoop/latestrelease/1141/Newscoop-355-and-Newscoop-4-RC4-security-releases.htm newscoop-multiple-xss(74781) https://www.htbridge.com/advisory/HTB23084 ** DISPUTED ** The wp_create_nonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a user session, which might make it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks on specific actions and objects by sniffing the network, as demonstrated by attacks against the wp-admin/admin-ajax.php and wp-admin/user-new.php scripts. NOTE: the vendor reportedly disputes the significance of this issue because wp_create_nonce operates as intended, even if it is arguably inconsistent with certain CSRF protection details advocated by external organizations. 18791 53280 http://www.webapp-security.com/2012/04/wordpress-3-3-1-multiple-csrf-vulnerabilities http://www.webapp-security.com/wp-content/uploads/2012/04/Wordpress-3.3.1-Multiple-CSRF-Vulnerabilities6.txt Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. SUSE-SU-2012:0746 openSUSE-SU-2012:0760 RHSA-2012:0710 RHSA-2012:0715 DSA-2488 DSA-2489 DSA-2499 MDVSA-2012:088 http://www.mozilla.org/security/announce/2012/mfsa2012-34.html https://bugzilla.mozilla.org/show_bug.cgi?id=643967 https://bugzilla.mozilla.org/show_bug.cgi?id=723465 https://bugzilla.mozilla.org/show_bug.cgi?id=745254 https://bugzilla.mozilla.org/show_bug.cgi?id=745494 https://bugzilla.mozilla.org/show_bug.cgi?id=745580 oval:org.mitre.oval:def:17055 Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 13.0, Thunderbird before 13.0, and SeaMonkey before 2.10 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) methodjit/ImmutableSync.cpp, (2) the JSObject::makeDenseArraySlow function in js/src/jsarray.cpp, and unknown other components. SUSE-SU-2012:0746 openSUSE-SU-2012:0760 RHSA-2012:0710 RHSA-2012:0715 MDVSA-2012:088 http://www.mozilla.org/security/announce/2012/mfsa2012-34.html 53796 https://bugzilla.mozilla.org/show_bug.cgi?id=670317 https://bugzilla.mozilla.org/show_bug.cgi?id=699594 https://bugzilla.mozilla.org/show_bug.cgi?id=708688 https://bugzilla.mozilla.org/show_bug.cgi?id=716067 https://bugzilla.mozilla.org/show_bug.cgi?id=718852 https://bugzilla.mozilla.org/show_bug.cgi?id=723773 https://bugzilla.mozilla.org/show_bug.cgi?id=723971 https://bugzilla.mozilla.org/show_bug.cgi?id=730415 https://bugzilla.mozilla.org/show_bug.cgi?id=736012 https://bugzilla.mozilla.org/show_bug.cgi?id=748948 oval:org.mitre.oval:def:17058 jsinfer.cpp in Mozilla Firefox ESR 10.x before 10.0.5 and Thunderbird ESR 10.x before 10.0.5 does not properly determine data types, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via crafted JavaScript code. SUSE-SU-2012:0746 RHSA-2012:0710 RHSA-2012:0715 DSA-2499 MDVSA-2012:088 http://www.mozilla.org/security/announce/2012/mfsa2012-34.html https://bugzilla.mozilla.org/show_bug.cgi?id=748613 Use-after-free vulnerability in the nsFrameList::FirstChild function in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) by changing the size of a container of absolutely positioned elements in a column. SUSE-SU-2012:0746 openSUSE-SU-2012:0760 RHSA-2012:0710 RHSA-2012:0715 DSA-2488 DSA-2489 DSA-2499 MDVSA-2012:088 http://www.mozilla.org/security/announce/2012/mfsa2012-40.html 53794 https://bugzilla.mozilla.org/show_bug.cgi?id=747688 oval:org.mitre.oval:def:17054 Heap-based buffer overflow in the nsHTMLReflowState::CalculateHypotheticalBox function in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 allows remote attackers to execute arbitrary code by resizing a window displaying absolutely positioned and relatively positioned elements in nested columns. SUSE-SU-2012:0746 openSUSE-SU-2012:0760 RHSA-2012:0710 RHSA-2012:0715 MDVSA-2012:088 http://www.mozilla.org/security/announce/2012/mfsa2012-40.html https://bugzilla.mozilla.org/show_bug.cgi?id=750066 oval:org.mitre.oval:def:16985 The Mozilla Updater and Windows Updater Service in Mozilla Firefox 12.0, Thunderbird 12.0, and SeaMonkey 2.9 on Windows allow local users to gain privileges by loading a DLL file in a privileged context. SUSE-SU-2012:0746 http://www.mozilla.org/security/announce/2012/mfsa2012-35.html http://www.mozilla.org/security/announce/2013/mfsa2013-45.html https://bugzilla.mozilla.org/show_bug.cgi?id=748764 oval:org.mitre.oval:def:16951 Untrusted search path vulnerability in Updater.exe in the Windows Updater Service in Mozilla Firefox 12.0, Thunderbird 12.0, and SeaMonkey 2.9 on Windows allows local users to gain privileges via a Trojan horse wsock32.dll file in an application directory. http://cwe.mitre.org/data/definitions/426.html 'CWE-426: Untrusted Search Path' SUSE-SU-2012:0746 http://www.mozilla.org/security/announce/2012/mfsa2012-35.html https://bugzilla.mozilla.org/show_bug.cgi?id=750850 oval:org.mitre.oval:def:16924 The Content Security Policy (CSP) implementation in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 does not block inline event handlers, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted HTML document. SUSE-SU-2012:0746 openSUSE-SU-2012:0760 RHSA-2012:0710 RHSA-2012:0715 MDVSA-2012:088 http://www.mozilla.org/security/announce/2012/mfsa2012-36.html https://bugzilla.mozilla.org/show_bug.cgi?id=751422 oval:org.mitre.oval:def:17005 Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 allow local users to obtain sensitive information via an HTML document that loads a shortcut (aka .lnk) file for display within an IFRAME element, as demonstrated by a network share implemented by (1) Microsoft Windows or (2) Samba. SUSE-SU-2012:0746 openSUSE-SU-2012:0760 RHSA-2012:0710 RHSA-2012:0715 MDVSA-2012:088 http://www.mozilla.org/security/announce/2012/mfsa2012-37.html https://bugzilla.mozilla.org/show_bug.cgi?id=670514 oval:org.mitre.oval:def:16743 Use-after-free vulnerability in the nsINode::ReplaceOrInsertBefore function in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 might allow remote attackers to execute arbitrary code via document changes involving replacement or insertion of a node. SUSE-SU-2012:0746 openSUSE-SU-2012:0760 RHSA-2012:0710 RHSA-2012:0715 MDVSA-2012:088 http://www.mozilla.org/security/announce/2012/mfsa2012-38.html https://bugzilla.mozilla.org/show_bug.cgi?id=750109 oval:org.mitre.oval:def:17010 Heap-based buffer overflow in the utf16_to_isolatin1 function in Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 allows remote attackers to execute arbitrary code via vectors that trigger a character-set conversion failure. SUSE-SU-2012:0746 openSUSE-SU-2012:0760 RHSA-2012:0710 RHSA-2012:0715 DSA-2488 DSA-2489 MDVSA-2012:088 http://www.mozilla.org/security/announce/2012/mfsa2012-40.html https://bugzilla.mozilla.org/show_bug.cgi?id=744541 oval:org.mitre.oval:def:16911